Flask-CORS appears configured to allow all origins

[Muskankr]

If Flask-CORS is set up with a wildcard (*) rather than the specific frontend domain, that's an unnecessary security exposure for a public API. Restrict Access-Control-Allow-Origin to the actual deployed frontend URL.