diff --git a/cdk/rocketnotes.go b/cdk/rocketnotes.go
index 088ba38c..0c7997c6 100644
--- a/cdk/rocketnotes.go
+++ b/cdk/rocketnotes.go
@@ -90,6 +90,7 @@ func RocketnotesStack(scope constructs.Construct, id string, props *RocketnotesS
 	httpApi := awscdkapigatewayv2alpha.NewHttpApi(stack, jsii.String("MyHttpApi"), &awscdkapigatewayv2alpha.HttpApiProps{
 		ApiName: jsii.String("MyHttpApi"),
 		CorsPreflight: &awscdkapigatewayv2alpha.CorsPreflightOptions{
+			// TODO - change this to the actual allowed origins
 			AllowOrigins: jsii.Strings("*"),
 			AllowHeaders: jsii.Strings("*"),
 			AllowMethods: &[]awscdkapigatewayv2alpha.CorsHttpMethod{
diff --git a/lambda-handler/archive-zettel-handler/main.go b/lambda-handler/archive-zettel-handler/main.go
index ce193bed..65d9e29d 100644
--- a/lambda-handler/archive-zettel-handler/main.go
+++ b/lambda-handler/archive-zettel-handler/main.go
@@ -138,6 +138,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/delete-zettel-handler/main.go b/lambda-handler/delete-zettel-handler/main.go
index 7557a53e..183a473e 100644
--- a/lambda-handler/delete-zettel-handler/main.go
+++ b/lambda-handler/delete-zettel-handler/main.go
@@ -62,6 +62,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/get-document-handler/main.go b/lambda-handler/get-document-handler/main.go
index d48dcb28..ab51647f 100644
--- a/lambda-handler/get-document-handler/main.go
+++ b/lambda-handler/get-document-handler/main.go
@@ -87,6 +87,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/get-document-tree-handler/main.go b/lambda-handler/get-document-tree-handler/main.go
index 491de839..797d34d4 100644
--- a/lambda-handler/get-document-tree-handler/main.go
+++ b/lambda-handler/get-document-tree-handler/main.go
@@ -84,6 +84,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/get-shared-document-handler/main.go b/lambda-handler/get-shared-document-handler/main.go
index bda2bdac..f14b7e8e 100644
--- a/lambda-handler/get-shared-document-handler/main.go
+++ b/lambda-handler/get-shared-document-handler/main.go
@@ -89,6 +89,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/get-user-config-handler/main.go b/lambda-handler/get-user-config-handler/main.go
index 9deda4f4..e6ce2798 100644
--- a/lambda-handler/get-user-config-handler/main.go
+++ b/lambda-handler/get-user-config-handler/main.go
@@ -77,6 +77,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/get-zettelkasten-handler/main.go b/lambda-handler/get-zettelkasten-handler/main.go
index ed86cd16..a4fb1225 100644
--- a/lambda-handler/get-zettelkasten-handler/main.go
+++ b/lambda-handler/get-zettelkasten-handler/main.go
@@ -81,6 +81,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/hello-world-handler/local.go b/lambda-handler/hello-world-handler/local.go
index a26d875a..b82d0561 100644
--- a/lambda-handler/hello-world-handler/local.go
+++ b/lambda-handler/hello-world-handler/local.go
@@ -33,6 +33,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/lambda-handler/save-document-handler/local.go b/lambda-handler/save-document-handler/local.go
index 25c97e57..ae9b505d 100644
--- a/lambda-handler/save-document-handler/local.go
+++ b/lambda-handler/save-document-handler/local.go
@@ -76,6 +76,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/save-document-public-handler/main.go b/lambda-handler/save-document-public-handler/main.go
index 990e5d7b..17cfc0fc 100644
--- a/lambda-handler/save-document-public-handler/main.go
+++ b/lambda-handler/save-document-public-handler/main.go
@@ -100,6 +100,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/save-document-title-handler/main.go b/lambda-handler/save-document-title-handler/main.go
index 0bdc79f3..1530b245 100644
--- a/lambda-handler/save-document-title-handler/main.go
+++ b/lambda-handler/save-document-title-handler/main.go
@@ -104,6 +104,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/save-document-tree-handler/main.go b/lambda-handler/save-document-tree-handler/main.go
index 326101c5..63f85990 100644
--- a/lambda-handler/save-document-tree-handler/main.go
+++ b/lambda-handler/save-document-tree-handler/main.go
@@ -70,6 +70,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/save-user-config-handler/main.go b/lambda-handler/save-user-config-handler/main.go
index 3a29f75f..ebe659e7 100644
--- a/lambda-handler/save-user-config-handler/main.go
+++ b/lambda-handler/save-user-config-handler/main.go
@@ -99,6 +99,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/save-vector-embeddings-handler/main.py b/lambda-handler/save-vector-embeddings-handler/main.py
index 3d7b67eb..1389e38a 100644
--- a/lambda-handler/save-vector-embeddings-handler/main.py
+++ b/lambda-handler/save-vector-embeddings-handler/main.py
@@ -194,6 +194,7 @@ def handler(event, context):
         "statusCode": 200,
         "headers": {
             "Content-Type": "application/json",
+            # TODO - change this to the actual allowed origins
             "Access-Control-Allow-Origin": "*",
         },
         "body": json.dumps("Success"),
diff --git a/lambda-handler/save-zettel-handler/main.go b/lambda-handler/save-zettel-handler/main.go
index 4a19250c..84f8871a 100644
--- a/lambda-handler/save-zettel-handler/main.go
+++ b/lambda-handler/save-zettel-handler/main.go
@@ -69,6 +69,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 	}, nil
diff --git a/lambda-handler/search-document-handler/main.go b/lambda-handler/search-document-handler/main.go
index 647a2b33..4b9f830d 100644
--- a/lambda-handler/search-document-handler/main.go
+++ b/lambda-handler/search-document-handler/main.go
@@ -94,6 +94,7 @@ func handleRequest(ctx context.Context, request events.APIGatewayProxyRequest) (
 	return events.APIGatewayProxyResponse{
 		StatusCode: 200,
 		Headers: map[string]string{
+			// TODO - change this to the actual allowed origins
 			"Access-Control-Allow-Origin": "*", // Required for CORS support to work locally
 		},
 		Body: string(b),
diff --git a/template.yaml b/template.yaml
index 3ecb2674..928e6f5e 100644
--- a/template.yaml
+++ b/template.yaml
@@ -8,6 +8,7 @@ Globals:
     Cors:
       AllowMethods: "'GET,POST,DELETE,OPTIONS'"
       AllowHeaders: "'content-type'"
+			// TODO - change this to the actual allowed origins
       AllowOrigin: "'*'"
       AllowCredentials: "'*'"