PatchVault › Errors › Vibe-coded app security

The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

The browser blocks a credentialed fetch (credentials: 'include' or withCredentials) because your API answers with Access-Control-Allow-Origin: *.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

Per the Fetch/CORS rules documented on MDN, the * wildcard is only honoured for requests without credentials. For credentialed requests the server must echo one explicit, allow-listed origin.

Manual fix

const ALLOWED = new Set(['https://app.example.com'])
const origin = req.headers.origin
if (ALLOWED.has(origin)) {
  res.setHeader('Access-Control-Allow-Origin', origin)
  res.setHeader('Access-Control-Allow-Credentials', 'true')
  res.setHeader('Vary', 'Origin')
}

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• MDN: Access-Control-Allow-Origin

Related errors

• GH013: Push cannot contain secrets: fix
• Supabase "new row violates row-level security policy"
• Supabase rls_disabled_in_public: table publicly accessible
• NEXT_PUBLIC_ service_role key: your Supabase admin key is in the browser bundle
• Stripe sk_live_ key hard-coded in source: rotate and move it

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.