zoom

The same-origin policy is not protecting your API

Zoom encoded a localhost server's responses in image dimensions to dodge CORS, exposing it to every website on the internet.