Use DateTimeOffset for instants that cross system boundaries
Use DateTimeOffset for timestamps sent through APIs, messages, or storage when they must identify one unambiguous point in time.
Api
Treat CORS as a browser boundary, not API authorization
Use CORS to control browser-script access across origins, while enforcing API permissions with authentication and authorization.
Keep public API DTOs separate from domain entities
Use explicit request and response contracts so persistence fields and domain state do not become part of the public API accidentally.