⚠️ ShipLatch educational DEMO — Permissive CORS (Access-Control-Allow-Origin: *). This is a fictional, deliberately-insecure teaching page run by ShipLatch. It is NOT a real app or company.

VulnBox API Home

Fictional app whose homepage returns Access-Control-Allow-Origin: *, letting any website read its responses in a visitor's browser. Scan it at shiplatch.com.