Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.
Why this matters
The CORS spec forbids Access-Control-Allow-Origin: * with credentials, so origin: true echoes the caller's origin back instead, effectively allowing credentialed cross-site requests from ANYWHERE. That is a CSRF / account-takeover primitive.
Enumerate the exact trusted origins instead: app.enableCors({ origin: ['https://app.example.com'], credentials: true }). If the API is public and needs no cookies or auth headers, keep credentials at its default false.
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.