cors-cross-origin-misconfiguration

Checks API cross-origin policies for flaws that let browsers read authenticated or sensitive data.

When to use it

Use when responses contain CORS headers, browser attacks might read authenticated APIs, or JSON endpoints are readable cross-origin.

Give it an API to test; it checks origin handling, credentialed reads, allowlist bypasses, and account or tenant impact.