diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40a155d92..c5b572bcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -79,6 +79,10 @@
   answer, since terrain does not move. Ordinary use is unaffected: a full
   `test:track` run drives 10 requests, peaking at 8/min.
 
+- `/api/terrain/heights` refuses cross-site browser requests before rate
+  limiting, cache access or upstream work. Same-origin app requests and
+  non-browser local callers remain supported.
+
 - Add an experimental ChatGPT/Codex OAuth option for cloud voice in Provider
   Settings. API-key voice remains the default. Local sign-in can start from
   the auth button and reports completion, failure, timeout, or expired
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index c7afdd24c..7c260baff 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1103,7 +1103,10 @@ plugin order, server-key selection, validation, disk caches, budgets, retries
 and stale/error responses remain unchanged. Each has a Node-only package entry
 under `gods-eye-view/server/providers/`. Portable terrain mechanics, traffic tile
 math and GBFS source rules are available under `gods-eye-view/sources/`.
-The browser layers and their rendering remain in their existing modules.
+The `/api/terrain/heights` route refuses cross-site browser requests before
+rate limiting, cache access or upstream work. Same-origin app requests and
+non-browser local callers remain supported in development and preview. The
+browser layers and their rendering remain in their existing modules.
 
 ## Terrain height cache bound