[BUG] CORS Allows All Origins

[olddev94]

Project

vgrep

Description

The vgrep server uses allow_origin(Any) for CORS, which allows any website to make requests to the local server. While this makes integration easy, it could allow malicious websites to:

• Search your codebase
• Extract code snippets from results
• Generate embeddings of sensitive data

Error Message

None - security issue.

Debug Logs

System Information

- Bounty Version: 0.1.0
- OS: Ubuntu 24.04 LTS
- Rust: 1.75+

Screenshots

No response

Steps to Reproduce

1. Start vgrep server: vgrep serve
2. Visit a malicious website
3. Website JavaScript makes fetch to http://127.0.0.1:7777/search
4. Website receives your search results

Expected Behavior

1. Default to localhost-only (no CORS needed)
2. Configurable allowed origins
3. Or require authentication for cross-origin requests

Actual Behavior

1. Any website can make requests to the server
2. No authentication required
3. Full access to search and embed endpoints

Additional Context

No response

[echobt]

Marking as invalid: A Pull Request addressing this issue already exists (CortexLM/vgrep#3).