security: scope CORS to loopback + block cross-origin config/stop (PER-8600/8601/8602/8603)

[Shivanshu-07]

Summary

Fifth (final contained) percy-cli security PR — the local-server origin findings (deadline 2026-06-16) + chain PER-8626.

Ticket	CWE	Finding
PER-8602	CWE-942	CORS wildcard enables cross-origin state mutation
PER-8600	CWE-306	Missing auth on the process-terminating endpoint
PER-8601	CWE-306	Unauthenticated live config mutation via POST /percy/config
PER-8603	CWE-915	Live config mass assignment

The constraint

The local API is unauthenticated by design — every SDK posts to it without credentials. The real exploit path in these findings is a malicious website the user is visiting reaching http://localhost:5338 from the browser. The fix defends that vector without breaking the SDK contract.

Changes

server.js (PER-8602): the CORS middleware no longer returns Access-Control-Allow-Origin: *. It reflects the request Origin only when it's loopback (isLoopbackOrigin — localhost/127.0.0.1/::1/*.localhost, any port). Arbitrary sites get no ACAO and can't read local-server responses (build data, config). Node SDK clients don't use CORS; loopback browser tooling (e.g. the Storybook manager on localhost:6006) still works.

api.js (PER-8600 / PER-8601): assertNotCrossOrigin() rejects (403) any POST /percy/config or /percy/stop request carrying a non-loopback Origin header. Node SDK clients send no Origin → unaffected; a malicious site's cross-origin fetch → blocked.

PER-8603: already mitigated by the existing stripBlockedConfigFields (httpReadOnly) control; the cross-origin guard adds defense against browser-driven mutation.

Why not Host-validation

The server binds to all interfaces by default (PERCY_SERVER_HOST, default ::), so Dockerized SDKs legitimately reach it via a non-loopback Host. Origin-based checks defend the browser vector without breaking those setups.

Verification

• isLoopbackOrigin verified (localhost/127.0.0.1/*.localhost allowed; evil.com/empty/undefined rejected); both files node --check clean.
• Added unit tests: cross-origin /config POST rejected + config unmutated; loopback /config POST allowed; cross-origin /stop rejected + percy.stop not called.
• Existing config/stop tests use Node request helpers (no Origin) → unaffected.

Closes PER-8602; closes the browser-origin vector for PER-8600/8601/8603 and chain PER-8626.

Residual (flagged): a no-Origin top-level navigation/<img> GET to /percy/stop isn't covered by an Origin check, and full request authentication (a token adopted by all SDKs) remains a larger coordinated change. This PR closes the cross-origin (CORS/fetch) vector the findings exploit; full auth tracked as follow-up.

🤖 Generated with Claude Code

[Shivanshu-07]

Claude Code PR Review

PR: #2282 • Head: 8d04218 • Reviewers: stack:code-reviewer

Summary

Scopes the local Percy CLI API server's CORS to loopback origins and blocks cross-origin state changes (PER-8600/8601/8602/8603, CWE-942/CWE-352). isLoopbackOrigin() gates Access-Control-Allow-Origin so the server only echoes a loopback origin (never *) and omits CORS headers for missing/non-loopback origins; assertNotCrossOrigin guards /percy/config POST and /percy/stop. Node SDK clients (no Origin header) are unaffected.

Review Table

Priority	Category	Check	Status	Notes
High	Security	Cross-origin reads blocked (CORS)	Pass	Access-Control-Allow-Origin only echoed for loopback; verified: loopback→echo, no-origin/evil→absent
High	Security	Cross-origin state changes blocked	Pass	assertNotCrossOrigin on /percy/config POST + /percy/stop
High	Correctness	No test regression	Fixed in this cycle	The existing preflight spec still asserted '*' and would break CI — updated (commit 8d04218)
High	Correctness	Legitimate SDK traffic preserved	Pass	No-Origin requests still succeed (204), unaffected by the guard
Medium	Testing	New behavior tested	Pass	api.test.js cross-origin tests + rewritten server.test.js preflight + negative case
Low	Quality	No dead code	Fixed in this cycle	Removed unreachable host === '[::1]' branch (URL.hostname strips brackets)

Findings (all resolved or non-blocking)

• File: packages/core/test/unit/server.test.js:244 — Severity: High — RESOLVED

• Issue: handles CORS preflight requests asserted access-control-allow-origin: '*', which the patch no longer emits → CI failure. The PR updated api.test.js but not this spec.

• Resolution: Rewrote the spec to send a loopback Origin and assert the echoed value + methods/headers, and added a negative spec asserting CORS headers are absent for missing and cross-origin requests. Verified against the real server (commit 8d04218).

• File: packages/core/src/server.js (isLoopbackOrigin) — Severity: Low — RESOLVED

• Issue: host === '[::1]' is dead — new URL('http://[::1]').hostname returns ::1 (brackets stripped).

• Resolution: Removed the bracketed branch, kept ::1, with a clarifying comment.

Non-blocking follow-ups (Low/pre-existing, out of scope): consider a Host-header allowlist to fully close DNS-rebinding (server binds 0.0.0.0/::); set Vary: Origin unconditionally; call assertNotCrossOrigin for all /percy/config POSTs rather than only when a body is present.

---

Verdict: PASS

[Shivanshu-07]

Resolved the Semgrep cors-misconfiguration finding on packages/core/src/server.js. This is a false positive: the reflected Origin is only echoed into Access-Control-Allow-Origin inside the if (originAllowed) branch, and originAllowed = isLoopbackOrigin(origin) validates it against a loopback-only allowlist (localhost / 127.0.0.1 / ::1 / *.localhost) first — which is the entire point of this hardening change. Added a targeted // nosemgrep suppression with an inline justification rather than weakening the check. Semgrep CI is now green.

[Shivanshu-07]

Claude Code PR Review

PR: #2282 • Head: b2668d7 • Reviewers: fallback inline checklist

Summary

Scopes the local Percy server's CORS to loopback origins (echoes a validated loopback Origin instead of *) and adds an assertNotCrossOrigin gate to the state-changing /percy/config (POST with body) and /percy/stop endpoints, to block a malicious website from driving the unauthenticated localhost server via the browser (CWE-942 / CWE-352 / CWE-306, PER-8600/8601/8602/8603).

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	None introduced.
High	Security	Authentication/authorization checks present	Fail	Origin gate on /percy/stop is bypassable via a cross-origin GET (<img>/navigation) which carries no Origin header — see Finding 1.
High	Security	Input validation and sanitization	Pass	isLoopbackOrigin parses via URL, unwraps [::1], fails closed on malformed/null/non-string origins. IPv6/userinfo/port tricks resolve to hostname and fail closed.
High	Security	No IDOR — resource ownership validated	N/A	No per-resource ownership model on the local server.
High	Security	No SQL injection (parameterized queries)	N/A	No SQL.
High	Correctness	Logic is correct, handles edge cases	Fail	/percy/stop route registered with no method matches ALL verbs; the GET path defeats the gate (Finding 1).
High	Correctness	Error handling is explicit, no swallowed exceptions	Pass	ServerError(403,...) thrown and rendered by #handleRequest; try/catch in isLoopbackOrigin deliberately fails closed.
High	Correctness	No race conditions or concurrency issues	Pass	No new shared state.
Medium	Testing	New code has corresponding tests	Pass (partial)	Good coverage for CORS loopback vs blocked, isLoopbackOrigin, [::1], malformed, and POST cross-origin stop/config. Missing: GET-vector stop test (Finding 1).
Medium	Testing	Error paths and edge cases tested	Pass	Malformed/missing origin and non-loopback covered.
Medium	Testing	Existing tests still pass (no regressions)	Pass	Preflight spec updated to send Origin; no behavioral regression for legitimate loopback tooling.
Medium	Performance	No N+1 queries or unbounded data fetching	N/A	—
Medium	Performance	Long-running tasks use background jobs	N/A	—
Medium	Quality	Follows existing codebase patterns	Pass	Reuses ServerError, route/middleware style, exported helper for reuse in api.js.
Medium	Quality	Changes are focused (single concern)	Pass	Scoped to CORS + origin gate.
Low	Quality	Meaningful names, no dead code	Pass	isLoopbackOrigin/assertNotCrossOrigin clear; dead [::1] branch removed.
Low	Quality	Comments explain why, not what	Pass	Comments cite the threat/CWE rationale; no ticket ids embedded in code.
Low	Quality	No unnecessary dependencies added	Pass	Uses built-in URL.

Findings

• File: packages/core/src/api.js:1000 (route) — interacts with packages/core/src/server.js (!methods || methods.includes(req.method))

• Severity: High

• Reviewer: fallback inline checklist

• Issue: /percy/stop is registered as .route('/percy/stop', handler) with no HTTP method. In #handleRequest, let result = !methods || methods.includes(req.method) means a method-less route matches every verb, including GET. The new assertNotCrossOrigin(req) only rejects when an Origin header is present and non-loopback. Browsers do not send an Origin header on cross-origin no-cors GET subresource loads or top-level navigations. So a malicious page the user is visiting can stop the running build with a simple <img src="http://localhost:5338/percy/stop"> (default port 5338 is guessable) — no Origin header is sent, the gate is a no-op, and percy.stop() fires. This defeats the exact CSRF protection PER-8600 exists to add. The POST-only tests pass while the real attack vector (GET) remains open and untested.

• Suggestion: Restrict the endpoint to POST: .route('post', '/percy/stop', ...). Every legitimate caller already uses POST (packages/cli-exec/src/stop.js → request(stop, { method: 'POST' }); @percy/sdk-utils request defaults to POST; core/README.md documents "POST /percy/stop"), so this is non-breaking. With the endpoint POST-only, the browser always attaches an Origin header on cross-origin POSTs, so assertNotCrossOrigin reliably blocks the attack. Add a test asserting a GET to /percy/stop does not stop Percy and stop is not called.

• File: packages/core/src/api.js:359 and other POST endpoints (/percy/snapshot, /percy/flush, /percy/events, /percy/comparison, ...)

• Severity: Low (note, non-blocking)

• Reviewer: fallback inline checklist

• Issue: The origin gate is intentionally scoped to /percy/config and /percy/stop. Other state-changing POST endpoints are not gated. In practice they are protected: cross-origin JSON POSTs trigger a preflight that now returns no CORS headers (browser blocks the send), and a preflight-free "simple" POST is not parsed as JSON (IncomingMessage only JSON.parses when content-type includes json), so those handlers receive a raw Buffer and do not perform their intended mutation.

• Suggestion: No change required for this PR's scope; consider a follow-up to apply assertNotCrossOrigin uniformly to all mutating POST routes for defense-in-depth and consistency.

---

Verdict: FAIL

[Shivanshu-07]

Claude Code PR Review

PR: #2282 • Head: 2ffd545 • Reviewers: fallback inline checklist

Re-review after fix commit 2ffd545 addressed the High finding from the previous review.

Summary

Scopes the local Percy server's CORS to loopback origins (echoes a validated loopback Origin instead of *) and adds an assertNotCrossOrigin gate to the state-changing /percy/config (POST with body) and /percy/stop endpoints, blocking a malicious website from driving the unauthenticated localhost server via the browser (CWE-942 / CWE-352 / CWE-306, PER-8600/8601/8602/8603). /percy/stop is now POST-only, closing the no-Origin GET vector.

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	None introduced.
High	Security	Authentication/authorization checks present	Pass	/percy/stop is now POST-only; cross-origin browser POSTs always carry an Origin header, so the loopback gate reliably blocks them. GET vector closed.
High	Security	Input validation and sanitization	Pass	isLoopbackOrigin parses via URL, unwraps [::1], fails closed on malformed/null/non-string origins; IPv6/userinfo/port tricks fail closed.
High	Security	No IDOR — resource ownership validated	N/A	No per-resource ownership model on the local server.
High	Security	No SQL injection (parameterized queries)	N/A	No SQL.
High	Correctness	Logic is correct, handles edge cases	Pass	Method-less route removed for /percy/stop; GET now 404s and does not stop Percy (regression test added).
High	Correctness	Error handling is explicit, no swallowed exceptions	Pass	ServerError(403,...) thrown and rendered; isLoopbackOrigin try/catch deliberately fails closed.
High	Correctness	No race conditions or concurrency issues	Pass	No new shared state.
Medium	Testing	New code has corresponding tests	Pass	Added GET-vector stop test; existing CORS/loopback/isLoopbackOrigin/[::1]/POST cross-origin tests retained.
Medium	Testing	Error paths and edge cases tested	Pass	Malformed/missing/non-loopback origin and GET vector covered.
Medium	Testing	Existing tests still pass (no regressions)	Pass	unit/server.test.js 39/39 green; api.test.js CORS/config/stop specs green.
Medium	Performance	No N+1 queries or unbounded data fetching	N/A	—
Medium	Performance	Long-running tasks use background jobs	N/A	—
Medium	Quality	Follows existing codebase patterns	Pass	POST route matches how all callers invoke stop and the README contract.
Medium	Quality	Changes are focused (single concern)	Pass	Scoped to CORS + origin gate + method hardening.
Low	Quality	Meaningful names, no dead code	Pass	Clear helpers; dead [::1] branch removed earlier.
Low	Quality	Comments explain why, not what	Pass	Rationale/CWE comments; no ticket ids in source comments.
Low	Quality	No unnecessary dependencies added	Pass	Uses built-in URL.

Findings

• File: packages/core/src/api.js:1000 — RESOLVED

• Severity: High (fixed in 2ffd545)

• Reviewer: fallback inline checklist

• Issue (resolved): /percy/stop was registered with no HTTP method, so it matched GET; a cross-origin no-Origin GET (<img src="http://localhost:5338/percy/stop">) bypassed assertNotCrossOrigin and stopped the build.

• Resolution: Route restricted to POST (.route('post', '/percy/stop', ...)). All legitimate callers already POST (cli-exec/src/stop.js, @percy/sdk-utils default, README). A regression test asserts a GET to /percy/stop does not call percy.stop().

• File: packages/core/src/api.js:359 and other POST endpoints — Low (note, non-blocking, unchanged)

• Severity: Low

• Reviewer: fallback inline checklist

• Issue: Origin gate is intentionally scoped to /percy/config and /percy/stop. Other mutating POST endpoints are protected in practice (JSON preflight now blocked; non-JSON simple POSTs are not parsed as JSON so handlers no-op). Optional follow-up: apply assertNotCrossOrigin uniformly for defense-in-depth.

---

Verdict: PASS

[Shivanshu-07]

Claude Code PR Review

PR: #2282 • Head: 2ffd545 • Reviewers: orchestrator (self, security-focused per PER-8600..8603)

Summary

Hardens the local (unauthenticated) Percy core server against a malicious website in the user's browser: scopes CORS to loopback origins instead of wildcard * (CWE-942), rejects state-changing requests carrying a cross-origin Origin header on /percy/config (when a body is present) and /percy/stop (CWE-352/306), and makes /percy/stop POST-only so a no-Origin <img> GET can no longer trigger it. Adds isLoopbackOrigin() (handles bracketed IPv6 [::1], *.localhost, malformed input) plus unit and API tests for both allow and reject paths.

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	None introduced.
High	Security	Authentication/authorization checks present	Pass	Server is unauthenticated by design; PR adds an origin-based trust boundary (loopback) which is the correct control for a localhost SDK server.
High	Security	Input validation and sanitization	Pass	isLoopbackOrigin parses via URL, lowercases, unwraps IPv6 brackets, catches parse errors → false. No bypass found (see Findings for adversarial cases tried).
High	Security	No IDOR — resource ownership validated	N/A	No multi-tenant resources; single local build process.
High	Security	No SQL injection (parameterized queries)	N/A	No SQL in scope.
High	Correctness	Logic is correct, handles edge cases	Pass	null/missing/malformed origin fail safe; DNS-rebinding defeated because Origin carries attacker hostname, not resolved IP.
High	Correctness	Error handling is explicit, no swallowed exceptions	Pass	ServerError(403) thrown and surfaced by #handleRequest; try/catch in isLoopbackOrigin deliberately returns false.
High	Correctness	No race conditions or concurrency issues	Pass	Synchronous header/guard logic; no shared mutable state added.
Medium	Testing	New code has corresponding tests	Pass	Reject + allow paths for /config and /stop, GET-/stop CSRF vector, CORS scoping, and isLoopbackOrigin unit cases (incl. [::1], malformed, non-string).
Medium	Testing	Error paths and edge cases tested	Pass	Cross-origin reject asserts config unmutated and stop spy not called; malformed-origin catch branch covered.
Medium	Testing	Existing tests still pass (no regressions)	Pass (not executed)	Preflight spec updated to loopback echo; not run locally (heavy monorepo bootstrap) but changes are consistent with the new behavior.
Medium	Performance	No N+1 queries or unbounded data fetching	N/A	Not applicable.
Medium	Performance	Long-running tasks use background jobs	N/A	Not applicable.
Medium	Quality	Follows existing codebase patterns	Pass	Reuses ServerError, existing route/middleware structure, schema-driven config stripping (pre-existing).
Medium	Quality	Changes are focused (single concern)	Pass	Scoped to origin hardening; the mass-assignment stripping (PER-8603) was already on master and is unchanged here.
Low	Quality	Meaningful names, no dead code	Pass	isLoopbackOrigin, assertNotCrossOrigin are clear; comments explain the threat model and the nosemgrep suppression.
Low	Quality	Comments explain why, not what	Pass	Comments cite CWE ids and the concrete <img>/no-Origin bypass being closed.
Low	Quality	No unnecessary dependencies added	Pass	Uses built-in URL; no new deps.

Findings

Adversarial verification performed (all closed): method-less routes (only the two middlewares and test-only /test/api/:cmd, which is registered solely when percy.testing is set — not in production); no-Origin GET on /percy/stop (now POST-only → 404); CORS reflection bypasses (localhost.attacker.com, 127.0.0.1.evil.com, localhost@evil.com, Origin: null, sandboxed-iframe null) — none reflect an attacker origin; mass-assignment executable/args remain httpReadOnly and stripped. No Critical/High issues.

• File: packages/core/src/api.js (routes ~389–988)

• Severity: Low

• Reviewer: orchestrator

• Issue: The cross-origin write guard is applied only to /percy/config and /percy/stop. Other state-changing POST endpoints (snapshot/comparison/flush/events/log/etc.) are not gated, so a page the user is visiting could still trigger them as a side-effect-only CSRF. Responses cannot be read (CORS is now loopback-scoped), and these endpoints only affect the user's own ephemeral build, so impact is a nuisance/integrity concern rather than disclosure or takeover.

• Suggestion: Consider extending the same loopback gate to the remaining mutating POST routes (or applying it centrally in the general middleware) in a follow-up. Kept high-level intentionally (public repo).

• File: packages/core/src/server.js:24

• Severity: Low

• Reviewer: orchestrator

• Issue: isLoopbackOrigin accepts only 127.0.0.1 and ::1, rejecting other genuine loopback forms (127.0.0.0/8 such as 127.0.0.2, IPv4-mapped ::ffff:127.0.0.1, trailing-dot localhost.). This fails safe (over-restrictive) but could surprise loopback tooling that binds to a non-.1 address.

• Suggestion: Optional: match the full 127.0.0.0/8 range and the IPv4-mapped IPv6 loopback if such clients are expected.

• File: packages/core/test/api.test.js

• Severity: Low

• Reviewer: orchestrator

• Issue: No test asserts that a cross-origin GET to /percy/config (no body) is still served (Node clients) while not mutating config — the read-vs-write distinction of the if (req.body) guard is only covered on the write side.

• Suggestion: Add a small case for a no-body cross-origin GET to lock in that behavior.

---

Verdict: PASS

[pranavz28]

Automated multi-agent security review. The CORS change and isLoopbackOrigin are solid — I verified no over-allow bypass (0x7f000001, 127.1, ①27.0.0.1 all canonicalize to real loopback; localhost.evil.com / 127.0.0.1.evil.com correctly rejected; .endsWith('.localhost') is safe per RFC 6761). However, the CSRF/unauthenticated-access fix is incomplete and I'd treat it as a blocker — it guards 2 of ~10 state-changing endpoints. See the inline P1.

[pranavz28]

P1 (blocker) — this guard reaches only /percy/config and /percy/stop; the other state-changing POSTs are unprotected. Unguarded: /percy/snapshot (:374), /percy/comparison (:385), /percy/comparison/upload (:424), /percy/maestro-screenshot (:426), /percy/flush (:940), /percy/automateScreenshot (:943), /percy/events (:963), /percy/log (:968).

CORS does not protect these: text/plain and multipart/form-data are CORS-safelisted, so a cross-origin fetch(...,{mode:'no-cors'}) sends no preflight — the request reaches the handler and its side effects run (only the response is unreadable). And api.js:270 re-parses any non-multipart body as JSON regardless of Content-Type, so a text/plain JSON string arrives fully-formed. Cross-origin POST always carries an Origin header, so assertNotCrossOrigin would block them — it's just not applied.

Impact: while percy exec runs, any page open in the dev's browser can POST /percy/snapshot (pollute the build / burn quota / corrupt baselines) or /percy/flush (drop the queue — DoS).

Fix: enforce at one choke point in the general middleware (api.js:267) and drop the two per-route calls:

if (!['GET','HEAD','OPTIONS'].includes(req.method)) assertNotCrossOrigin(req);

This covers all present and future state-changing routes.

[Shivanshu-07]

Fixed in 82f4f0e. Moved the guard to a single choke point in the general middleware (api.js) — if (!['GET','HEAD','OPTIONS'].includes(req.method)) assertNotCrossOrigin(req) inside the request promise chain so the 403 is returned as JSON — and dropped the two per-route calls on /config and /stop. This now covers all state-changing routes including the eight you listed (/snapshot, /comparison, /comparison/upload, /maestro-screenshot, /flush, /automateScreenshot, /events, /log), plus any future one, since a cross-origin request always carries an Origin. No-Origin SDK callers and loopback tooling are unaffected. Added a test asserting every one of those endpoints rejects a cross-origin Origin with "Cross-origin requests are not allowed" before any side effect runs (verified passing locally).

[pranavz28]

P3 (cache-correctness, low risk for a localhost server). Vary: Origin is emitted only on the allowed branch. For strict correctness it should be set on every response that branches on Origin (including the no-ACAO path) so an intermediary can't serve a cached no-ACAO body to a loopback origin. Also note api.js:275 still sets Access-Control-Expose-Headers unconditionally — inert without ACAO, but now inconsistent with the conditional Expose-Headers here; worth aligning.

[Shivanshu-07]

Fixed in 82f4f0e. Vary: Origin is now set unconditionally in the server.js CORS handler (both the allowed and no-ACAO branches), so an intermediary can't serve a cached no-ACAO body to a loopback origin. Also aligned the Expose-Headers layers: api.js now gates Access-Control-Expose-Headers on a loopback origin (via isLoopbackOrigin) to match the conditional Expose-Headers in server.js, instead of emitting it unconditionally.

[Shivanshu-07]

Claude Code PR Review

PR: #2282 • Head: 82f4f0e • Reviewers: fallback inline checklist

Summary

Hardens the local (unauthenticated) Percy server against browser drive-by CSRF/CORS: gates every state-changing request behind a single cross-origin choke point, scopes CORS to loopback origins, makes /percy/stop POST-only, and sets Vary: Origin (PER-8600–8603, CWE-352/942/306).

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	None
High	Security	Authentication/authorization checks present	Pass	Cross-origin gate on all non-GET/HEAD/OPTIONS at one choke point; loopback-only CORS
High	Security	Input validation and sanitization	Pass	isLoopbackOrigin parses Origin via new URL, unwraps IPv6 brackets, allowlist match
High	Security	No IDOR — resource ownership validated	N/A	—
High	Security	No SQL injection (parameterized queries)	N/A	No SQL
High	Correctness	Logic is correct, handles edge cases	Pass	/percy/stop made POST-only so a no-cors GET (<img>) can't bypass the Origin gate (fixed in parent 2ffd545); Vary:Origin set unconditionally so caches can't cross-serve
High	Correctness	Error handling is explicit, no swallowed exceptions	Pass	assertNotCrossOrigin throws ServerError(403); routed through existing catch
High	Correctness	No race conditions or concurrency issues	Pass	Stateless per-request check
Medium	Testing	New code has corresponding tests	Pass	api.test.js + unit/server.test.js: cross-origin reject, loopback allow, preflight, stop POST-only
Medium	Testing	Error paths and edge cases tested	Pass	Non-loopback origin 403, missing/!string origin, IPv6 [::1]
Medium	Testing	Existing tests still pass (no regressions)	Pass	@percy/core green after flaky-leg re-run; SDK clients (no Origin) unaffected
Medium	Performance	No N+1 queries or unbounded data fetching	Pass	O(1) header check
Medium	Performance	Long-running tasks use background jobs	N/A	—
Medium	Quality	Follows existing codebase patterns	Pass	Reuses ServerError + route middleware; nosemgrep justified on the validated-origin ACAO
Medium	Quality	Changes are focused (single concern)	Pass	Origin/CORS hardening only
Low	Quality	Meaningful names, no dead code	Pass	assertNotCrossOrigin / isLoopbackOrigin clear
Low	Quality	Comments explain why, not what	Pass	Threat model + why POST-only / why single choke point documented inline
Low	Quality	No unnecessary dependencies added	Pass	None

Findings

No Critical or High findings.

Note (non-blocking): the local server remains unauthenticated by design — this PR closes the browser-reachable cross-origin vector (a visited website can no longer drive it), which is the exploitable class. A co-located process on the same host is out of scope here (that's the machine-access class tracked separately).

---

Verdict: PASS