But what about those vulnerabilities is specific to being on a private network? If we can find a public website with the same vulnerability, will we start enforcing stricter CORS requirements everywhere?