clawbot
ba79d6de02
check / check (push) Waiting to run
CORS() allowed every origin with credentials, so a page on another origin of the same site could read what the signed-in user sees. CORS() now uses the CONVENTIONS.md template's options (AllowedOrigins "*", AllowCredentials false) and covers only the two public, read-only routes, GET /api/v1/server and GET /.well-known/healthcheck.json. Every other route sends no Access-Control-Allow-* header. A preflight to the public routes gets 405 like any other path. Deviation: CORS() is not in the global middleware chain CONVENTIONS.md lists, because REPO_POLICIES.md forbids * on authenticated routes. Model: opus-5-5