Configured security headers, CORS and secrets

The security section of dusk.config.ts sets the same options as createHandler (allowedHosts, headers, csp, csrf, limits, trustProxy, nonce), plus trustedOrigins (origins that may send state-changing requests and absolute redirects) and cors. CORS applies to API routes only: cors.origins lists the origins that may read an API answer, and a preflight from a listed origin is answered before the route runs. Server functions are same-origin and checked by CSRF, so they take no CORS setting. An origin that is not listed gets no Access-Control-* header. Credentials are only allowed for listed origins, and there is no wildcard.

Secrets are never written in the file, because the file is written into the server bundle: cookieSecrets is refused there. The draft-mode secret is read from the environment at request time (DUSK_DRAFT_SECRET by default), and the draft endpoints take it from a POST body, never from a URL. A deployment id (the x-dusk-deployment header) is not a secret; it is only compared, to refuse calls from another build with 409 DEPLOYMENT_MISMATCH.