Check CORS and security headers set in code
A reflected Access-Control-Allow-Origin with credentials, set in application code, is a data-theft primitive.
Tag: cors
Reflected CORS with credentials for data theft
An origin-reflecting ACAO plus allow-credentials lets any site read authenticated API responses in the victim's browser.