From Client Regex to Server Bug: We Hunted CORS and CSRF

Introduction CORS misconfigurations are everywhere. But spotting the real ones takes more than payloads — it takes understanding the trust model hidden beneath the surface. This is a short story of ho