sc-cors

Detect CORS misconfigurations in web APIs during HTTP discovery.

56|5|Updated Apr 8, 2026

Search Tags:#security #vulnerability #cors #misconfiguration #web-api #origin

Ready to run

npx skills add https://github.com/ersinkoc/security-check --skill sc-cors

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-cors
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-cors
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-cors

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CORS misconfigurations can expose sensitive APIs to unintended origins, enabling data leakage and misuse. This skill identifies risky patterns that allow unauthorized cross-origin access, such as wildcard origins with credentials or unsafe origin reflection.

Core Features & Use Cases

Detect wildcard origins used with credentials and other unsafe patterns.
Detect reflected origin handling that echoes request origins without proper validation.
Detect null-origin allowances and weak regex-based allowlists that enable bypasses.
Provide actionable remediation guidance to tighten CORS policies in web APIs.

Quick Start

Use the CORS scan against your API to identify misconfigurations and insecure origins.

Frequently Asked Questions about sc-cors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect CORS misconfigurations in my web API?▼

To detect CORS misconfigurations, scan your web API for wildcard origins used with credentials, unsafe origin reflection, null-origin allowances, and weak regex-based allowlists that enable bypasses.

What makes a CORS configuration vulnerable to unauthorized cross-origin access?▼

A CORS configuration becomes vulnerable when it reflects request origins without validation, allows null origins, or uses wildcard origins alongside credentials, exposing sensitive APIs to data leakage and misuse.

How do I check if my regex-based CORS allowlist can be bypassed?▼

Check your regex-based CORS allowlist by evaluating origin checks and header handling across deployments to identify weak patterns that fail to properly validate origins and enable bypasses.

Can I scan for unsafe origin reflection across multiple API deployments?▼

Yes, you can apply CORS scanning during HTTP API discovery to evaluate origin checks, header handling, and regex-based allowlists across all your deployments to ensure strict origin validation.

How do I fix CORS policies that allow wildcard origins with credentials?▼

Fix wildcard origins with credentials by enforcing strict origin allowlists, ensuring proper credential handling, and configuring safe default responses to prevent unauthorized cross-origin access.