From 7235ca1897e523c71ddd9d062fb54a3d095e59e4 Mon Sep 17 00:00:00 2001
From: Stephan D <sdeshevikh@yandex.ru>
Date: Wed, 25 Feb 2026 23:02:18 +0100
Subject: [PATCH] restricted CORS settings

---
 api/server/config.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/api/server/config.yml b/api/server/config.yml
index 42440297..e94ccb5d 100755
--- a/api/server/config.yml
+++ b/api/server/config.yml
@@ -16,7 +16,9 @@ api:
     CORS:
       max_age: 300
       allowed_origins:
-        - "*"
+        - "https://sendico.io"
+        - "https://app.sendico.io"
+        - "https://www.sendico.io"
       allowed_methods:
         - "GET"
         - "POST"