{"action":"created","issue":{"url":"https://api.github.com/repos/hoist/api.hoi.io/issues/6","labels_url":"https://api.github.com/repos/hoist/api.hoi.io/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/hoist/api.hoi.io/issues/6/comments","events_url":"https://api.github.com/repos/hoist/api.hoi.io/issues/6/events","html_url":"https://github.com/hoist/api.hoi.io/pull/6","id":108555400,"number":6,"title":"cors","user":{"login":"mejamiewilson","id":40936,"avatar_url":"https://avatars.githubusercontent.com/u/40936?v=3","gravatar_id":"","url":"https://api.github.com/users/mejamiewilson","html_url":"https://github.com/mejamiewilson","followers_url":"https://api.github.com/users/mejamiewilson/followers","following_url":"https://api.github.com/users/mejamiewilson/following{/other_user}","gists_url":"https://api.github.com/users/mejamiewilson/gists{/gist_id}","starred_url":"https://api.github.com/users/mejamiewilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mejamiewilson/subscriptions","organizations_url":"https://api.github.com/users/mejamiewilson/orgs","repos_url":"https://api.github.com/users/mejamiewilson/repos","events_url":"https://api.github.com/users/mejamiewilson/events{/privacy}","received_events_url":"https://api.github.com/users/mejamiewilson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-27T19:15:08Z","updated_at":"2015-09-27T20:24:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/hoist/api.hoi.io/pulls/6","html_url":"https://github.com/hoist/api.hoi.io/pull/6","diff_url":"https://github.com/hoist/api.hoi.io/pull/6.diff","patch_url":"https://github.com/hoist/api.hoi.io/pull/6.patch"},"body":""},"comment":{"url":"https://api.github.com/repos/hoist/api.hoi.io/issues/comments/143592484","html_url":"https://github.com/hoist/api.hoi.io/pull/6#issuecomment-143592484","issue_url":"https://api.github.com/repos/hoist/api.hoi.io/issues/6","id":143592484,"user":{"login":"buildmaster","id":19946,"avatar_url":"https://avatars.githubusercontent.com/u/19946?v=3","gravatar_id":"","url":"https://api.github.com/users/buildmaster","html_url":"https://github.com/buildmaster","followers_url":"https://api.github.com/users/buildmaster/followers","following_url":"https://api.github.com/users/buildmaster/following{/other_user}","gists_url":"https://api.github.com/users/buildmaster/gists{/gist_id}","starred_url":"https://api.github.com/users/buildmaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/buildmaster/subscriptions","organizations_url":"https://api.github.com/users/buildmaster/orgs","repos_url":"https://api.github.com/users/buildmaster/repos","events_url":"https://api.github.com/users/buildmaster/events{/privacy}","received_events_url":"https://api.github.com/users/buildmaster/received_events","type":"User","site_admin":false},"created_at":"2015-09-27T20:24:53Z","updated_at":"2015-09-27T20:24:53Z","body":"my concern with this is that we shouldn't be encouraging front end access via the API direct. The API keys arent' secure for that. They have no sense of permissions, or being able to regenerate or anything really. So once your API key is out in the wild anyone can use it to access your event stream and any sense of privacy/security is gone. Not to do with CORS specifically but the API key in front end JavaScript is a BAD idea"}}