- Shipped
- 16 ஜூலை, 2026 அன்று 12:21 AM UTC
- Author
- Kamo
- Commit
- f11a888
Phase-0 widgets still call via their server-side proxy, so origin-locking has no benefit yet and every live public-chat key has an empty allow-list. Strict enforcement (empty=deny, missing-Origin=deny) broke the marketing + sign.pink chat AND regressed VOIP-recording-upload / subscription-catalog keys that share the cached validator. Opt-in: no configured origins => allow; missing Origin => allow; only a key that set an allow-list with a present, non-matching Origin is denied. Phase 1 flips this to mandatory once keys have origins configured.