https://github.com/arduino/arduino-create-agent/blob/devel/main.go#L220 Right now we cycle on every port and add too many CORS headers. It will allow an attacker to run a process on localhost and use our own certificate.