Develop

[CodeMeAPixel]

No description provided.

[github-actions]

📊 Code Coverage Report

Total Coverage: 1.7%

View Full Report

[sentry]

Bug: The default CORS_ORIGINS includes http://localhost:3000. With AllowCredentials: true, this is a security risk if the environment variable is not explicitly set in production.
_{Severity: MEDIUM}

Suggested Fix

Remove http://localhost:3000 from the default CORS_ORIGINS value. Alternatively, implement environment-aware defaults, providing a different, more restrictive set of origins for production environments compared to development. This ensures development origins are not accidentally enabled in production.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: internal/config/config.go#L72

Potential issue: The default value for `CORS_ORIGINS` was changed to include
`http://localhost:3000`. This origin is now allowed by default in all environments. The
CORS configuration in `cmd/api/main.go` has `AllowCredentials: true` hardcoded. If the
`CORS_ORIGINS` environment variable is not explicitly set in a production deployment,
the API will accept credentialed requests from `http://localhost:3000`. This is a
security misconfiguration that violates the principle of least privilege by including a
development-specific origin in the production default settings.

_{Did we get this right? 👍 / 👎 to inform future reviews.}