Mexico City's Pricing API, and the CORS That Queried DNS

Our Mexico City retail company runs a pricing API in Go with Gin. A backend engineer asked an AI for 'CORS middleware for Gin.' It returned a module path. He added it to go.mod.

It was a hallucination. The name sounded like an official Gin contribution but wasn't published by the Gin team. Registered versions logged every request's Authorization header to a file and attempted DNS-based exfiltration of accumulated tokens to an attacker-controlled domain on a timer.

For ten days, every bearer token sent to our pricing API was logged and queued for exfiltration. The API kept working. CORS kept working. The theft was silent.

We found it when our DNS resolver logs showed periodic queries to an unusual domain from the API pod, on a fixed timer. A timer in a CORS middleware has no business making DNS queries. One curious platform engineer, and the whole thing unraveled.

We rotated all bearer tokens. We removed the module and used github.com/gin-contrib/cors. We reviewed the window: the tokens were for our retail partners' pricing access. We notified the affected partners.

The lesson we now teach every new hire: an AI-suggested Go module path is not a real path until you've seen it in the proxy with the right checksum. The build will happily resolve a name a machine made up, and the binary will quietly phone home.