# Implementation: fix-dashboard-cors-origin

## Bug
Dashboard's `app.py` set `Access-Control-Allow-Origin: *` (wildcard CORS) on all responses via `CORS_HEADERS`. Since the dashboard is a local single-origin app, this wildcard CORS header is unnecessary and poses a security risk — any malicious webpage on the machine could make requests to the dashboard API.

## Fix
1. Removed `CORS_HEADERS` dictionary (which contained `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Methods`)
2. Added `SECURITY_HEADERS` with `X-Content-Type-Options: nosniff` and `X-Frame-Options: DENY`
3. Updated `_send_json()`, `_send_error()`, and `do_OPTIONS()` to use `SECURITY_HEADERS` instead of `CORS_HEADERS`
4. `do_OPTIONS()` no longer returns `Access-Control-Allow-*` headers — it simply returns 204 No Content

## Files Changed
- `automaton/dashboard/ui/app.py`: Replaced `CORS_HEADERS` with `SECURITY_HEADERS`, updated all response methods
- `tests/test_app.py`: Updated CORS-related tests to assert NO `Access-Control-Allow-Origin` header is present, and that security headers are sent

## Tests
- `test_app.py` tests updated to verify security headers (`X-Content-Type-Options`, `X-Frame-Options`) and absence of CORS headers
- All 249 tests pass