API open to requests from any website
Partialmedium severity · reads .ts .tsx .js .jsx .mjs .cjs .pyBeta
Marked Partial: fine for a public, read-only API. Risky when the API uses cookies or returns user data. When Lintsure finds this, it marks it as Partial: it may be fine, depending on context only you can confirm.
What it looks like
A line Lintsure flags in its own test app:
// src/more.ts
app.use(cors({ origin: "*" }));How to fix it
List the exact origins that may call the API.
Through a coding agent, Lintsure suggests the change and waits. Nothing is edited until you approve it.
Controls it relates to
What the framework asks
SOC 2 CC6.6: Boundary protection
Systems are protected from outside threats at their edges.
Evidence a reviewer may ask for: Network and API access settings.
ISO 27001 A.8.20: Network security
Networks and connections are protected and controlled.
Evidence a reviewer may ask for: Network and TLS settings.
Summaries are our own reading of the public texts, not the official wording.
Read more: Which SOC 2 controls you can check in code
Check your code for this
Runs on your machine. Your code is never uploaded.
npx lintsure scanThis rule is in Beta: its mapping to framework controls is waiting for review by a qualified compliance professional. Lintsure is a readiness tool, not an audit or legal advice. A finding, or the lack of one, doesn't make you compliant. Disclaimer