Treat CORS as a browser boundary, not API authorization
Use CORS to control browser-script access across origins, while enforcing API permissions with authentication and authorization.
Api
Keep public API DTOs separate from domain entities
Use explicit request and response contracts so persistence fields and domain state do not become part of the public API accidentally.