diff --git a/content/docs/decap-proxy.md b/content/docs/decap-proxy.md
index ac5875cf..0c62eef6 100644
--- a/content/docs/decap-proxy.md
+++ b/content/docs/decap-proxy.md
@@ -31,7 +31,9 @@ backend:
 
 ## Options
 
-By default, the proxy server runs on port `8081` and allows CORS requests from any origin. You can customize these settings with these options.
+By default, the proxy server runs on port `8081` and allows CORS requests only from local development origins that match `/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/`. You can customize these settings with these options.
+
+This default was introduced in decap-server@3.8.0 as a security hardening measure. Before, the default was `*`.
 
 #### Environment Variables
 
@@ -39,7 +41,7 @@ By default, the proxy server runs on port `8081` and allows CORS requests from a
 
 * **`BIND_HOST`** variable allows binding to 127.0.0.1 rather than all IP addresses. Running `BIND_HOST=localhost npm run start` allows connecting to `http://localhost:8081/` but connections to `http://<public_ip>:8081/` are no longer possible. <span class="version-tag">3.9</span>
 
-* **`ORIGIN`** allows restricting CORS responses to a specific origin rather than allowing the API to be accessed from any server. Running `ORIGIN=https://example.com npm run start` changes the HTTP header in responses to `Access-Content-Allow-Origin: https://example.com`. The server can no longer be accessed by arbitrary websites. <span class="version-tag">3.9</span>
+* **`ORIGIN`** allows overriding the default local-only CORS origin pattern (`/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/`) with a specific origin. Running `ORIGIN=https://example.com npm run start` changes the HTTP header in responses to `Access-Content-Allow-Origin: https://example.com`. The server can no longer be accessed by arbitrary websites. <span class="version-tag">3.9</span>
 
 You can define them in 2 ways:
 
diff --git a/content/docs/widgets/markdown.md b/content/docs/widgets/markdown.md
index 1d7a5796..b8148bed 100644
--- a/content/docs/widgets/markdown.md
+++ b/content/docs/widgets/markdown.md
@@ -23,7 +23,7 @@ The markdown widget provides a full-fledged text editor, allowing users to forma
 * `buttons`: an array of strings representing the formatting buttons to display (all shown by default). Buttons include: `bold`, `italic`, `strikethrough`, `code`, `link`, `heading-one`, `heading-two`, `heading-three`, `heading-four`, `heading-five`, `heading-six`, `quote`, `bulleted-list`, and `numbered-list`.
 * `editor_components`: an array of strings representing the names of editor components to display (all shown by default). Decap CMS includes `image` and `code-block` editor components by default, and custom components may be [created and registered](/docs/custom-widgets/#registereditorcomponent).
 * `modes`: an array of strings representing the names of allowed editor modes. Possible modes are `raw` and `rich_text`. A toggle button appears in the toolbar when more than one mode is available.
-* `sanitize_preview`: accepts a boolean value, `false` by default. Sanitizes markdown preview to prevent XSS attacks - might alter the preview content.
+* `sanitize_preview`: accepts a boolean value, `true` by default. Sanitizes markdown preview to prevent XSS attacks - might alter the preview content. *This default changed from `false` to `true` in decap-cms@3.13.0 as a security hardening measure.*
 
 **Example**
 
diff --git a/content/docs/widgets/richtext.md b/content/docs/widgets/richtext.md
index a965f9cb..5118d37a 100644
--- a/content/docs/widgets/richtext.md
+++ b/content/docs/widgets/richtext.md
@@ -24,7 +24,7 @@ The richtext widget provides a full-fledged text editor, allowing users to forma
 * `buttons`: an array of strings representing the formatting buttons to display (all shown by default). Buttons include: `bold`, `italic`, `strikethrough`, `code`, `link`, `heading-one`, `heading-two`, `heading-three`, `heading-four`, `heading-five`, `heading-six`, `quote`, `bulleted-list`, and `numbered-list`.
 * `editor_components`: an array of strings representing the names of editor components to display (all shown by default). Decap CMS includes `image` and `code-block` editor components by default, and custom components may be [created and registered](/docs/custom-widgets/#registereditorcomponent).
 * `modes`: an array of strings representing the names of allowed editor modes. Possible modes are `raw` and `rich_text`. A toggle button appears in the toolbar when more than one mode is available.
-* `sanitize_preview`: accepts a boolean value, `false` by default. Sanitizes markdown preview to prevent XSS attacks - might alter the preview content.
+* `sanitize_preview`: accepts a boolean value, `true` by default. Sanitizes markdown preview to prevent XSS attacks - might alter the preview content. *This default changed from `false` to `true` in decap-cms@3.13.0 as a security hardening measure.*
 
 **Example**