{"uid":"cap_OtZz7eXytMZPKXIyOHwyS","slug":"sitecheck-cors-security-misconfiguration-audit-ce0e242c","name":"SiteCheck CORS Security Misconfiguration Audit","description":"CORS check for a public HTTPS endpoint: three GET requests with a made-up origin, the null origin and no origin, reporting whether the server echoes the origin, allows null, returns a wildcard, and allows credentials. Only reads response headers of GET requests; it does not test preflight, methods or authentication.","url":"https://api.fadeandco.workers.dev/api/agent-intel/cors-security-misconfig-audit?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Public https:// endpoint address"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"url":"https://httpbin.org/get","note":"GET responses only. Preflight (OPTIONS), other methods and authenticated responses are not tested.","level":"HIGH","probes":{"noOrigin":{"status":200,"allowOrigin":"*","allowCredentials":true},"nullOrigin":{"status":200,"allowOrigin":"null","allowCredentials":true},"customOrigin":{"status":200,"allowOrigin":"https://cors-audit-probe.invalid","allowCredentials":true}},"source":"https://httpbin.org/get","findings":[{"issue":"origin-reflection","detail":"server echoes an arbitrary origin","severity":"high"},{"issue":"null-origin-allowed","detail":"server allows the null origin","severity":"medium"}],"checkedAt":"2026-10-23T09:35:21.968Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_nMB2zIkaX2Gf40Xl903AU","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Tests a public HTTPS endpoint for CORS misconfigurations by sending GET requests with a custom origin, null origin, and no origin, then reporting whether the server reflects origins, allows null, returns wildcards, or allows credentials.","exampleAgentPrompt":"Can you run a CORS misconfiguration audit on https://api.myapp.com/v1/users and tell me if it reflects arbitrary origins, allows null origins, or has any dangerous credential settings?","exampleUseCases":[{"title":"Pre-launch API security review","prompt":"Before we go live, can you check https://api.mycompany.com/public/data for CORS misconfigurations — specifically whether it reflects arbitrary origins or allows credentials with a wildcard?"},{"title":"Bug bounty CORS recon","prompt":"I'm doing a security assessment on https://portal.targetsite.com/api/profile — run a CORS audit and tell me if there are any high or medium severity findings like null-origin acceptance or origin reflection."},{"title":"Dev environment header sanity check","prompt":"Can you audit https://staging.myservice.dev/api/v2/items for CORS issues and let me know the severity level and exactly which probes triggered findings?"}],"resultDescription":"A JSON object containing the audited URL, a severity level (e.g. HIGH, MEDIUM, LOW), probe results for three origin scenarios (no origin, null origin, custom origin) each with HTTP status and Access-Control-Allow-Origin / Access-Control-Allow-Credentials header values, a list of specific findings with issue type, detail, and severity, and a checkedAt timestamp. Note: only GET response headers are tested; preflight (OPTIONS), other HTTP methods, and authenticated flows are not covered.","failureModes":["Non-HTTPS or non-public URL provided — endpoint requires a public https:// address","Target server is unreachable or returns connection errors — probe results may be incomplete","Target rate-limits the audit probes — may return unexpected status codes skewing results","Server returns no CORS headers at all — findings list will be empty but not an error","Malformed URL input — will likely return a validation error"],"whenToPreferThis":"Use this endpoint when you need a quick, automated CORS security check on a public GET-accessible HTTPS endpoint without setting up local tooling. It is best suited for pre-deployment checks, recon during security assessments, or validating that a third-party API you rely on doesn't have dangerous CORS policies. Prefer alternatives if you need preflight (OPTIONS) testing, POST/PUT method coverage, or authenticated session CORS behavior, as this endpoint only inspects GET response headers.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T00:34:24.125Z","isFirstParty":false,"canonicalSlug":"sitecheck-cors-security-misconfiguration-audit-ce0e242c"}