Why it matters
With this combination, any website a signed-in user visits can make requests to your API as that user and read the answers. It turns a harmless-looking header into account data leaking to strangers.
How Patch checks
We take the API requests your own pages make, repeat a few of them with a made-up Origin header, and check whether the response echoes that origin back with Access-Control-Allow-Credentials: true. Known backend services with their own controls, such as Supabase, are skipped.
How to fix it
- On the affected endpoints, replace the reflected origin with an explicit allow-list.
- Only send Access-Control-Allow-Credentials: true for origins on that list.
- Never combine credentials with a wildcard or a reflected Origin.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.