========================================
[Sun Feb  8 23:47:59 AEDT 2026] CC VPS triggered by Rivet
========================================

Task:
Fix bug: Localhost in production CORS in api/company-logo/route.ts:130-134. Currently includes http://localhost:3000 in allowed origins unconditionally. Gate it behind NODE_ENV === 'development' check so it only allows localhost in dev mode.
----------------------------------------

Fixed. Changed `ALLOWED_ORIGINS` in `src/app/api/company-logo/route.ts:130-134` to only include localhost URLs when `NODE_ENV === 'development'`. Production deployments now only allow the configured `NEXT_PUBLIC_APP_URL` origin.

----------------------------------------
[Sun Feb  8 23:49:17 AEDT 2026] Task finished (exit code: 0)