From the checkup catalog
A CORS policy that lets any site read the response
What ShipCheck sends, and why a reflected origin with credentials is a finding.
The checkup requests the page with an Origin header, the way a browser on another site would. It does not try to steal a session.
A finding means the response allowed that origin, or used a wildcard together with credentials. Lock the allow-list to the origins you actually use.