> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withheadlight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Known footguns

# Known footguns

## Trailing slash on frameOrigin

Mint compares exact strings. `https://your-app.example.com/` will fail if the allowlisted origin is `https://your-app.example.com`.

## Mutable embed URLs

Never load `/chart/latest`. Pin `/chart/v<semver>/index.html`. A directory URL (`/chart/v<semver>/`) will not load the chart.

## TOKEN\_KEY\_UNKNOWN

If you see this error, pin a newer embed version.

## postMessage targetOrigin

Always pass the embed CDN origin to `postMessage`. Using `*` defeats origin checks on the parent side.