Defensive security scanner for dangerous CORS configurations: origin reflection, null-origin trust, allowlist matching bugs. Reports exploitability with remediation. CLI plus GitHub Action, SARIF output, Python 3 stdlib only.

Professional bug bounty report demonstrating a CORS misconfiguration caused by basic origin reflection, including vulnerability analysis, impact assessment, reproduction steps, remediation guidance, and proof-of-concept from a PortSwigger Web Security Academy lab.