services.wealthfolio.corsAllowOrigins

Comma-separated list of allowed CORS origins.

Security Note: The server panics at startup if * is used while authentication is enabled, as this is a CSRF vector. Set explicit origins matching your deployment URL (scheme + host + port).