Security Finding (Informational) SEC-025: Debug Tokens Exposed in CORS Headers

[DyanGalih]

Finding ID: SEC-025
Location: config/packages/nelmio_cors.yaml

CORS expose_headers includes X-Debug-Token and X-Debug-Token-Link, exposing profiler/debug URLs in cross-origin responses.

Impact: Debug tokens and profiler URLs may be leaked to cross-origin clients.

Remediation (short): Remove these debug headers from production CORS configuration.

Reference: SECURITY_REVIEW.md