Each instance of toctoctoc should have its own easily-configurable allowlist And a versionned file isn't the way It probably should be an environment variable. The value could be a comma-separated list of origins (+ #6 )