# Code Review: fix-dashboard-cors-origin

## Reviewed Files
- `automaton/dashboard/ui/app.py` (`SECURITY_HEADERS`, `_send_json()`, `_send_error()`, `do_OPTIONS()`)
- `tests/test_app.py`

## Changes
Removed wildcard CORS headers (`Access-Control-Allow-Origin: *`), replaced with security headers (`X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`).

## Analysis
- **Security**: Removing wildcard CORS eliminates the risk of cross-origin attacks from malicious local web pages
- **Single-origin app**: The dashboard is a local web app served from a single origin — CORS is unnecessary
- **Security headers**: `X-Content-Type-Options: nosniff` prevents MIME type sniffing, `X-Frame-Options: DENY` prevents clickjacking
- **OPTIONS handler**: `do_OPTIONS()` still returns 204 No Content (for preflight requests) but without CORS headers
- **Tests**: Test assertions correctly verify absence of CORS headers and presence of security headers

## Verdict: PASS

The fix eliminates a security vulnerability while adding useful hardening headers. Tests are properly updated.