https://dotpane.com/blog Guides for people who build their own dashboards: hiding API keys, fixing CORS errors, sandboxing untrusted code, and panes worth copying. en Wed, 11 Nov 2026 00:00:00 GMT https://dotpane.com/blog/cors-error-fetch https://dotpane.com/blog/cors-error-fetch The browser, not the server, blocks your fetch. What the CORS error means, why no-cors doesn’t help, and which fix fits an API you own or one you don’t. Wed, 11 Nov 2026 00:00:00 GMT https://dotpane.com/blog/hide-api-key-frontend-javascript https://dotpane.com/blog/hide-api-key-frontend-javascript You can’t hide an API key in frontend JavaScript: the browser has to send it. Here are the three ways to keep it on a server, and what each costs. Wed, 11 Nov 2026 00:00:00 GMT https://dotpane.com/blog/ssrf-protection-fetch-endpoint https://dotpane.com/blog/ssrf-protection-fetch-endpoint How to stop a server that fetches URLs from reaching your private network: private ranges, DNS rebinding, redirects and IPv6, with working Node code. Wed, 11 Nov 2026 00:00:00 GMT