Defer mandatory-origin to Phase 1 — OriginMatcher opt-in (empty allow-list / missing Origin allowed)

Shipped: July 16, 2026 at 12:21 AM UTC
Author: Kamo
Commit: f11a888

Phase-0 widgets still call via their server-side proxy, so origin-locking has no benefit yet and every live public-chat key has an empty allow-list. Strict enforcement (empty=deny, missing-Origin=deny) broke the marketing + sign.pink chat AND regressed VOIP-recording-upload / subscription-catalog keys that share the cached validator. Opt-in: no configured origins => allow; missing Origin => allow; only a key that set an allow-list with a present, non-matching Origin is denied. Phase 1 flips this to mandatory once keys have origins configured.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free Forever View Pricing