Skip to main content
August 28, 2026 Documentation correction Review recommended

​
Affects

Teams that expose Tracer to browser clients.

​
What changed

The documentation now clarifies that an unset or empty CORS_ALLOWED_ORIGINS allows every origin. Configure an explicit comma-separated allow-list in production. This is a documentation correction of the current runtime behavior; it does not announce a runtime release.

​
Impact

Classification: Review recommended.

​
What you need to do

Review Tracer deployment values. Do not leave the variable empty if you expect CORS to deny cross-origin browser requests.

​
Deadline

Review before the next production deployment.