Decide whether localhost belongs in the validator's ALLOWED_ORIGINS

[hhkaos]

workers/validator/wrangler.jsonc still carries:

"ALLOWED_ORIGINS": "https://tools.opentechevents.org,http://localhost:8000,http://127.0.0.1:8000"

That allowlist governs who may call the production /fetch endpoint cross-origin. Production has been same-origin since the page and /fetch moved onto validator.opentechevents.org, so neither entry is load-bearing for the deployed tool.

What the localhost entries buy: pnpm dev on port 8000 can use the deployed fetcher instead of running one locally.

What they cost: any page served from anyone's localhost can drive a public endpoint that makes outbound HTTP requests on its behalf. The per-IP rate-limit binding is the only thing bounding that; nothing else is.

https://tools.opentechevents.org is worth re-checking at the same time — that hostname now only redirects to the canonical URL, so it may not need to be in the list either.

Decide

• Keep the localhost entries (dev convenience wins), or drop them and have pnpm dev run its own fetcher.
• Keep or drop https://tools.opentechevents.org.
• If anything is dropped, confirm local dev still has a documented path in apps/validator/README.md — trap 8 in HANDOFF.md is about exactly the failure mode a missing fetcher produces locally.

Not urgent, and not a bug: a judgement call nobody has made yet.