✨ Customizable allowed origins

apps/docs/openapi/builder.json

@@ -27457,6 +27457,17 @@
                 "type": "boolean"
               }
             }
+          },
+          "security": {
+            "type": "object",
+            "properties": {
+              "allowedOrigins": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
           }
         },
         "title": "Settings"

apps/docs/openapi/viewer.json

@@ -7679,6 +7679,17 @@
                 "type": "boolean"
               }
             }
+          },
+          "security": {
+            "type": "object",
+            "properties": {
+              "allowedOrigins": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
           }
         },
         "title": "Settings"

apps/docs/settings/overview.mdx

@@ -36,6 +36,17 @@ return new Promise((res) => setTimeout(res, 3000))
 
 You can tweak `3000` (3s) to your liking.
 
+## Security
+
+By default, your typebot can be executed from any origin but you can restrict the execution of your typebot to specific origins. This is useful if you want to embed your typebot in your website and prevent it from being executed on other websites by malicious actors.
+
+For example, if you want to allow your typebot to be executed only on `https://my-company.com`, you can add `https://my-company.com` to the list of allowed origins.
+
+<Warning>
+  If you add a URL to the list but omit https://typebot.co, then your typebot
+  shareable URL will not work anymore.
+</Warning>
+
 ## Metadata
 
 In the Metadata section, you can customize how the preview card will look if you share your bot URL on social media for example.