varutasu da50d78406 fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5) ... Closes P0 #5 from PARTIAL to RESOLVED. Sweeps the remaining 24 pages/api/** handlers that carried the identical scaffolded wildcard-CORS + OPTIONS preflight pattern (Brief 4 cleaned login + register; this finishes the job). Adds a blocking forbidden-cors-headers CI job modeled on forbidden-endpoints to lock the cleanup against future regression. 25 files changed (+29/-261). Local: lint 128 baseline, vitest 21/21, zero CORS matches, YAML valid. CI: Playwright smoke 3/3 in 3.3s against post-removal preview (login/verify flow still works), new forbidden-cors-headers job passes in 4s, all gates green. PR #19 architect-commit ec22b70, implementer-commit a843736.		2026-05-24 20:41:38 -05:00
..
[identifier]	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
[identifier].js	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00