CORS Config Review: test results

Verdicts

Date

2026-10-19

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 3 cases, read by hand. On the Express handler it gave the suffix check and the missing Vary and left out the public status route. On the nginx file it gave the reflected origin in the upload location and the null entry in the map, and left out the exact allow-list. On the clean Flask handler it answered exactly No findings.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on 2 of 3 cases, read by hand. It was right on the nginx file and on the clean Flask handler. On the Express handler it gave the suffix check and the missing Vary but also an origin-reflected line, although a comparison exists, and a wildcard-with-credentials line for the status route. The second remark is defensible, because the global middleware sets the credentials header before that route sets the star for a matching origin, so our bait was not fully clean; the reflection line contradicts the skill definition. The check counts both as misses and it is recorded as a wrong answer.

Note

Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts. One input (the Express handler) turned out to carry an unintended second defect in the bait, disclosed in the verdicts.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.