[security] M-5 and M-6: Wildcard CORS on admin endpoint and default origins

[jacobyoby]

Severity: Medium (2 findings)

M-5: Wildcard CORS on admin endpoint

File: admin/views.py:178

M-6: CORS origins default to wildcard

File: socketserver.py:43-44

Remediation

Replace origins='*' with explicit allowlists. Restrict CORS to trusted origins only.

Source

Findings from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.