Two response headers decide the blast radius: Allow-Origin says who may read the reply, Allow-Credentials says whether cookies ride along. Reflection turns both into a leak.