CWE-346: CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

This report is not public...