> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Tracer CORS default

> An unset or empty CORS_ALLOWED_ORIGINS allows every origin; configure an explicit allow-list in production.

<Badge stroke icon="calendar-days" iconType="regular">August 28, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation correction</Badge> <Badge color="purple" size="lg" stroke icon="eye" iconType="regular">Review recommended</Badge>

## Affects

Teams that expose Tracer to browser clients.

## What changed

The documentation now clarifies that an unset or empty `CORS_ALLOWED_ORIGINS` allows every origin. Configure an explicit comma-separated allow-list in production. This is a documentation correction of the current runtime behavior; it does not announce a runtime release.

## Impact

**Classification: Review recommended.**

## What you need to do

Review Tracer deployment values. Do not leave the variable empty if you expect CORS to deny cross-origin browser requests.

### Deadline

Review before the next production deployment.