diff --git a/app/classes/ReleaseInsights/Json.php b/app/classes/ReleaseInsights/Json.php
index 4a46fef..e949311 100644
--- a/app/classes/ReleaseInsights/Json.php
+++ b/app/classes/ReleaseInsights/Json.php
@@ -33,7 +33,7 @@ public function output(): string
         }
 
         ob_start();
-        header("access-control-allow-origin: *");
+        header("access-control-allow-origin: *"); // * is OK as our Json API is public and readonly
         header("Content-type: {$mime}; charset=UTF-8");
         header("Content-Length: " . strlen($json));
         echo $json;