I pointed the scanner at merakislove.com last week, my own domain, the one with my name on it, the one I send prospects to as proof I practice what I sell.
It came back with a wildcard CORS header.
For twenty-plus years I've worked across software, security, and AI. I hold a CISSP. I built the exact ZAP and ExploitDB stack that caught this, running self-hosted through Claude Code. The credentials and the tooling didn't stop the gap from existing. They're what caught it. That distinction matters more than the header itself.
What the scan found
An Access-Control-Allow-Origin: * header, open to any origin calling the site instead of the specific domains that should have access. I traced it back to Vercel's CDN default. I hadn't set it myself.
That's an easy thing to inherit and an easy thing to miss. The site still looks fine from the outside. Nothing breaks, nothing errors. It sits there, wider open than it should be, until someone runs the right scan, or someone with worse intentions finds it first.
The fix, and the part most self audits skip
Scoping the header down to the actual allowed origins took minutes. Confirming the fix held took longer, and that second part is where most self audits fall apart.
ZAP caches session results. Rerun a scan against the same URL you just tested and you can get a clean read that has nothing to do with whether your fix actually worked. I pulled fresh URLs for the before and after checks to rule that out. A scan you can't trust is worse than no scan at all. It hands you false confidence instead of an honest answer.
Why I'm writing this instead of quietly fixing it and moving on
Most of the small business sites I look at were built fast, by people juggling a dozen other priorities, with security somewhere on a list they never got back to. I get it. I run a solo studio too. I know exactly what that list looks like.
The gap on my own site is a blind spot every builder carries somewhere, the kind that only surfaces when someone looks with the right tools instead of trusting the platform defaults to cover it.
What this built
The ZAP and ExploitDB stack that caught this now backs a Review package I run through Meraki is Love. Five days, five hundred to fifteen hundred dollars depending on scope, a CISSP-informed pass across your site for exactly this kind of gap, run by someone who just found one on his own.
If you want to know what's sitting open on your own site, the review is live on merakislove.com. Ask, and I'll tell you what I find, the way I just told you what I found on mine.
Top comments (0)