A non-ASCII character in an internal warning header was causing scan preview calls to fail with a 500 whenever isPublic: true was included in the request. For callers behind a proxy — such as a Cloudflare Worker — the error surfaced as a CORS failure, which made it look like a configuration problem rather than a server-side crash.
The warning text is now ASCII-safe in headers. The full warning still appears in the JSON response body and _pendium metadata, so nothing is lost on your end.