CORS Hardening — orchestkit.vercel.app

Restrict Access-Control-Allow-Origin from wildcard to same-origin.

Before (Vercel default)

Access-Control-Allow-Origin: *

Any website can fetch docs content via JavaScript cross-origin requests.

After

Access-Control-Allow-Origin: https://orchestkit.vercel.app

Only same-origin requests allowed. Cross-origin JavaScript requests blocked.

Changed file

docs/site/next.config.mjs — 1 line added to security headers array