diff --git a/PROJECTS/bug-bounty-platform/.env.example b/PROJECTS/bug-bounty-platform/.env.example
index 45170193..84399470 100644
--- a/PROJECTS/bug-bounty-platform/.env.example
+++ b/PROJECTS/bug-bounty-platform/.env.example
@@ -72,12 +72,12 @@ REFRESH_TOKEN_EXPIRE_DAYS=7
 ADMIN_EMAIL=
 
 # =============================================================================
-# CORS (must match HOST PORTS above!)
+# CORS
 # =============================================================================
-# Format: http://localhost:<NGINX_HOST_PORT>,http://localhost:<FRONTEND_HOST_PORT>
-# Update these if you change the host ports above
+# Use ["*"] to allow all origins (public API)
+# Or specify origins: ["http://localhost:8420","http://localhost:3420"]
 
-CORS_ORIGINS=http://localhost,http://localhost:8420,http://localhost:3420
+CORS_ORIGINS=["*"]
 
 # =============================================================================
 # Rate Limiting
diff --git a/PROJECTS/bug-bounty-platform/README.md b/PROJECTS/bug-bounty-platform/README.md
index 07ca4eea..4c0266e8 100644
--- a/PROJECTS/bug-bounty-platform/README.md
+++ b/PROJECTS/bug-bounty-platform/README.md
@@ -258,6 +258,7 @@ All configuration is done via `.env` file. Key variables:
 | `ENVIRONMENT` | dev/staging/production | development |
 | `ACCESS_TOKEN_EXPIRE_MINUTES` | JWT access token lifetime | 15 |
 | `REFRESH_TOKEN_EXPIRE_DAYS` | Refresh token lifetime | 7 |
+| `CORS_ORIGINS` | Allowed origins for CORS | `["*"]` (all origins) |
 
 See `.env.example` for all available options.
 
@@ -271,9 +272,20 @@ BACKEND_HOST_PORT=5420      # Change to any available port
 FRONTEND_HOST_PORT=3420     # Change to any available port
 POSTGRES_HOST_PORT=4420     # Change to any available port
 REDIS_HOST_PORT=6420        # Change to any available port
+```
 
-# IMPORTANT: Update CORS_ORIGINS to match NGINX_HOST_PORT
-CORS_ORIGINS=http://localhost,http://localhost:8420,http://localhost:3420
+### CORS Configuration
+
+The API is configured to accept requests from **all origins** by default:
+
+```bash
+CORS_ORIGINS=["*"]  # Allows all origins (public API)
+```
+
+If you need to restrict access to specific origins:
+
+```bash
+CORS_ORIGINS=["https://yourdomain.com","https://app.yourdomain.com"]
 ```
 
 ---
diff --git a/PROJECTS/bug-bounty-platform/backend/app/config.py b/PROJECTS/bug-bounty-platform/backend/app/config.py
index 75f34345..0b8e844c 100644
--- a/PROJECTS/bug-bounty-platform/backend/app/config.py
+++ b/PROJECTS/bug-bounty-platform/backend/app/config.py
@@ -158,11 +158,7 @@ class Settings(BaseSettings):
 
     REDIS_URL: RedisDsn | None = None
 
-    CORS_ORIGINS: list[str] = [
-        "http://localhost",
-        "http://localhost:3420",
-        "http://localhost:8420",
-    ]
+    CORS_ORIGINS: list[str] = ["*"]
     CORS_ALLOW_CREDENTIALS: bool = True
     CORS_ALLOW_METHODS: list[str] = [
         "GET",