SEV-3: reported, blocks only with --strict

Any website can call your API

What goes wrong

Another site calls your endpoints from its own pages, and you never see it in your logs as a problem.

Replace the wildcard with the exact origins of your app.

npx sigship

Run it in your project. It reports this check as cors-wildcard, along with 16 others. Nothing leaves your machine.