diff --git a/env.example b/env.example
new file mode 100644
index 0000000..814ad70
--- /dev/null
+++ b/env.example
@@ -0,0 +1,6 @@
+# Copy this file to .env.local and set the real value.
+# NO `VITE_` prefix — the secret stays server-side and is never bundled.
+HASURA_ADMIN_SECRET=your-hasura-admin-secret-here
+
+# Optional production server port (defaults to 3000)
+# PORT=3000
diff --git a/package-lock.json b/package-lock.json
index 96a37fd..9bf76ae 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -67,6 +67,7 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1477,6 +1478,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.12",
         "caniuse-lite": "^1.0.30001782",
@@ -2335,6 +2337,7 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -2691,6 +2694,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -2912,6 +2916,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
       "integrity": "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -3400,6 +3405,7 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3525,6 +3531,7 @@
       "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.4",
@@ -3618,6 +3625,7 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
diff --git a/src/components/TopicView.jsx b/src/components/TopicView.jsx
index 48f5c48..c31883d 100644
--- a/src/components/TopicView.jsx
+++ b/src/components/TopicView.jsx
@@ -11,7 +11,10 @@ function toProxyPath(fullUrl) {
   if (fullUrl.startsWith(LEGACY_BASE_URL)) {
     return fullUrl.slice(LEGACY_BASE_URL.length)
   }
-  // REST API (jupiter.nearle.app): Has native CORS enabled, browser hits it directly!
+  // REST API (jupiter.nearle.app): Proxy requests through local server to avoid CORS issues
+  if (fullUrl.startsWith(REST_BASE_URL)) {
+    return fullUrl.slice(REST_BASE_URL.length)
+  }
   return fullUrl
 }