From e25c66b7376870acd78d0000803480ced62a7201 Mon Sep 17 00:00:00 2001 From: Bruno Perez Date: Tue, 12 May 2026 12:56:13 +0200 Subject: [PATCH] fix: let any Manifest dashboard embed the Wingman drawer frame-ancestors was 'self' https://*.manifest.build, which only covered the cloud dashboard at app.manifest.build. Localhost dev dashboards and any self-hosted Manifest instance got blocked with a "refused to connect" page when opening the drawer. The drawer is a public dev tool with no first-party backend. API keys flow directly from the iframe to whatever baseUrl the user types, and the backend's CORS is the actual gate. A "hostile" embedder can't read anything useful from inside, so frame-ancestors * is the right level. --- vercel.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vercel.json b/vercel.json index 2f75417..bdfec01 100644 --- a/vercel.json +++ b/vercel.json @@ -6,7 +6,7 @@ "headers": [ { "key": "Content-Security-Policy", - "value": "frame-ancestors 'self' https://*.manifest.build" + "value": "frame-ancestors *" }, { "key": "X-Content-Type-Options", "value": "nosniff" }, { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },