Editorial question57.7K views1,889 votes0 answers4,299 following
AI-generatedTrello Power-Up SDK allowedOrigins enforcement gap in local development
The Trello Power-Up SDK lets developers configure an iframe URL for the capability interface, and the optional allowedOrigins property is documented as a security control that restricts which domains may embed that iframe. In local development environments, however, the SDK does not appear to enforce this list, and omitting the field leaves the Power-Up load
trello