Lovable
Open CORS on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
A wildcard Access-Control-Allow-Origin on the public response.
What the scan can see
Access-Control-Allow-Origin: * is a medium finding. The same wildcard with Access-Control-Allow-Credentials: true is higher. Browsers reject that pair, but it shows the config is confused.
What it does not do
CORS on an API host you did not paste is not checked. The scan does not send a credentialed browser request to prove data leaks.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Remove the wildcard from a page that does not need it. On an API, list the exact origins you own. Do not copy the request Origin into the response without checking it.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove open cors is fully fixed?
CORS on an API host you did not paste is not checked. The scan does not send a credentialed browser request to prove data leaks.
What should I do if the scan finds it?
Remove the wildcard from a page that does not need it. On an API, list the exact origins you own. Do not copy the request Origin into the response without checking it.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.