Marius Horatau

I'm a senior security engineer at Amazon and a penetration tester specialising in web and API security. I came up through full-stack engineering and still write code daily. That background lets me bridge engineering and security: when I break something, I also understand how it was built and how to fix it so the issue does not return.

I have more than 15 years of experience in security. For the past six years, my full-time focus has been solving complex security problems at scale and finding high-impact vulnerabilities, which means a lot of time spent on authentication flows, API design decisions, and cross-service trust boundaries.

CORS sits right on one of those boundaries, and it's the one developers hit most. Almost everyone meets it as an error message and learns to make the error go away — usually by loosening something they don't fully understand. That's how the same handful of misconfigurations end up in production over and over.

I built I-Hate-CORS to fix that. The course and everything I write here start from how the browser actually behaves, so that the fix you ship is the correct one rather than the one that happened to stop the console from complaining.