Does Bolt.new add CORS protection?

Bolt.new frequently generates API routes with overly permissive CORS configurations, often setting Access-Control-Allow-Origin to wildcard (*). This allows any website to make requests to your API, which can be exploited for data theft if combined with authentication tokens stored in cookies. Proper CORS configuration should whitelist only your own domain and explicitly specify allowed methods and headers. Misconfigured CORS is one of the top issues found in AI-generated web applications. UNPWNED tests your CORS configuration and reports overly permissive settings.