From 5dcc87776f0c614178e8557600e9741eeee561be Mon Sep 17 00:00:00 2001
From: brain-marchine <152466993+brain-marchine@users.noreply.github.com>
Date: Sun, 12 Jul 2026 17:19:31 +0800
Subject: [PATCH] docs: document CORS allowlist and preflight behaviour

Fixes #6
---
 docs/cors.md | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 docs/cors.md

diff --git a/docs/cors.md b/docs/cors.md
new file mode 100644
index 0000000..e1ab0a1
--- /dev/null
+++ b/docs/cors.md
@@ -0,0 +1,8 @@
+# CORS configuration
+
+StableRoute backend enables CORS via the `cors` package with an environment-driven
+allowlist (`CORS_ORIGINS`). Preflight `OPTIONS` requests pass through even when
+the service is paused so browser clients can recover gracefully.
+
+See `src/__tests__/cors.test.ts` for regression coverage of preflight headers on
+`/api/v1/pairs` and pause-mode behaviour.