What are the security concerns with CORS (Cross-Origin Resource Sharing) in REST APIs?

Short answer: Malicious sites could misuse APIs if CORS is too permissive. Always restrict origins (Access-Control-Allow-Origin). Avoid * in production. Use tokens for security.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.