The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 19, 2026 2:43am

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

PR Summary

Medium Risk
Touches security-sensitive CORS behavior and preflight handling across all API routes, which could break cross-origin clients or inadvertently widen/restrict access if policies are incorrect.

Overview
CORS handling for /api/* is centralized in proxy.ts: a per-route policy table now sets Access-Control-* headers at request time (including a uniform OPTIONS short-circuit), avoiding build-time baked origins.

This removes static CORS headers from next.config.ts, deletes several route-level OPTIONS handlers plus their preflight tests, and drops the Docker build-time NEXT_PUBLIC_APP_URL placeholder that was only needed for the previous build-time CORS approach.

^{Reviewed by Cursor Bugbot for commit 3a8349d. Configure here.}

Greptile Summary

This PR fixes a production CORS misconfiguration where NEXT_PUBLIC_APP_URL was frozen at build time (defaulting to http://localhost:3000), causing browsers to reject credentialed API requests in production. All /api/* CORS handling is moved from the static next.config.ts headers into a runtime middleware function (resolveApiCorsPolicy in proxy.ts), and the eight per-route OPTIONS handlers that were made redundant are removed.

• proxy.ts: Adds resolveApiCorsPolicy — a route-specific CORS policy table covering auth, MCP, form, and workflow execute paths — and short-circuits preflight OPTIONS requests uniformly in middleware before they reach route handlers.
• next.config.ts: Drops all Access-Control-* headers that were baked at build time; retains non-CORS security headers (COEP/COOP) for workflow execution routes.
• docker/app.Dockerfile: Removes the build-time NEXT_PUBLIC_APP_URL ARG/ENV placeholder since the value is now read from the runtime environment.

Confidence Score: 3/5

The reflected-origin form route path needs Vary: Origin and the double CORS header application needs resolution before this is production-safe for form embeds.

The reflected-origin form route path sets Access-Control-Allow-Origin dynamically but omits Vary: Origin, a cache-poisoning vector for any CDN in front of the app. addCorsHeaders is also still called inside the form route handler while the middleware sets the same headers, risking duplicate Access-Control-Allow-Origin values that browsers reject.

apps/sim/proxy.ts (applyCorsHeaders, buildPreflightResponse, and the /api/form branch of resolveApiCorsPolicy) and apps/sim/app/api/form/[identifier]/route.ts (addCorsHeaders calls that now overlap with middleware)

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Browser
    participant Proxy as proxy.ts (middleware)
    participant Handler as Route Handler

    Browser->>Proxy: "OPTIONS /api/* (preflight)"
    Proxy->>Proxy: resolveApiCorsPolicy(request)
    Proxy-->>Browser: 204 + CORS headers (short-circuit)

    Browser->>Proxy: GET/POST /api/form/[id]
    Proxy->>Proxy: resolveApiCorsPolicy reflect Origin
    Proxy->>Handler: NextResponse.next() + CORS headers
    Handler->>Handler: addCorsHeaders() still called internally
    Handler-->>Proxy: Response + CORS headers again
    Proxy-->>Browser: Merged response potential duplicate CORS headers

_{Reviews (1): Last reviewed commit: "fix(security): remove localhost CORS ori..." | Re-trigger Greptile}