GHSA-c65f-x25w-62jv

### Summary

Both standalone servers configure CORS with `allow_origins=["*"]`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`.

### Affected Code

```python # server/key-server/app/main.py:86-92 # server/telemetry-server/app/main.py:23-29 app.add_middleware( CORSMiddleware, allow_origins=settings.cors_origins, # defaults to ["*"] allow_credentials=True, allow_methods=["*"], allow_headers=["*"], ) ```

The docker-compose file (`openssl_encrypt_server/docker-compose.yml:75`) also defaults `CORS_ORIGINS` to `*`, and `.env.example` ships with `CORS_ORIGINS=*`.

### Impact

This is the most permissive CORS configuration possible, allowing any website to make fully credentialed cross-origin requests to the API. An attacker's website could make authenticated API calls on behalf of any user who visits it.

### Recommended Fix

- Remove wildcard defaults — require explicit origin configuration - Never combine `allow_origins=["*"]` with `allow_credentials=True` - Update `.env.example` with placeholder domains instead of `*`

### Fix

Fixed in commit `809416b` on branch `releases/1.4.x` — changed CORS default from ["*"] to [] in both key-server and telemetry-server; added validation rejecting wildcard when debug=False.