note Apis
CORS Is Not Security (and Your Rate Limiter Probably Isn't Global)
CORS only tells browsers what they may read, and the built-in rate limiter counts per instance. Both work in the demo and leak in production once you forget which assumption you were making.