The $0 Misconfiguration That Exposed 10M Rows: CORS Blindness

The press release calls it a 'sophisticated cyberattack.' The headers tell a different story: 'Access-Control-Allow-Origin: *' coupled with credentials. This is not a zero-day; it is a misconfigured trust boundary.