diff --git a/backend/app/config.py b/backend/app/config.py
index 84c2825..6e9ef3b 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -30,6 +30,14 @@ class Settings(BaseSettings):
     SUPABASE_KEY: str = ""
     SUPABASE_BUCKET_NAME: str = "resumes"
 
+    # CORS
+    CORS_ORIGINS: list[str] = [
+        "http://localhost:5173",
+        "http://localhost:3000",
+        "http://127.0.0.1:5173",
+        "http://127.0.0.1:3000",
+    ]
+
     # Piston (code execution)
     PISTON_URL: str = "http://localhost:2000"
 
diff --git a/backend/app/main.py b/backend/app/main.py
index 1e49fd4..6e90964 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -45,7 +45,7 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]:
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=settings.CORS_ORIGINS,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],