diff --git a/README.md b/README.md
index ef20716..c5e1cb5 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,8 @@ A single-file, offline-friendly companion page for 100%-ing **Metal Gear Solid 2
 
 ## Hosting it (GitHub Pages, Netlify, Cloudflare Pages, Neocities…)
 
+**This copy is deployed at <https://rain.pages.melonbread.xyz/la-li-lu-le-lo/>**, served from the `pages` branch of <https://git.melonbread.xyz/rain/la-li-lu-le-lo>.
+
 **The page itself hosts fine as-is.** It is one static HTML file with all the guide data, the 10 area maps and the colour coding baked in, and it stores progress in the browser's `localStorage`. Drop it in a repo, enable Pages, done. No build step, no dependencies.
 
 Two things behave differently on a static host:
@@ -65,11 +67,11 @@ Double-click `index.html`. Everything works except live Steam sync. Note that op
 
 ## Steam sync
 
-- Enter your **vanity name** (e.g. `mrmelonbread`) or **SteamID64** on the **🔄 Steam Sync** tab and hit **Sync now**.
+- Enter your **vanity name** (e.g. `gaben`) or **SteamID64** on the **🔄 Steam Sync** tab and hit **Sync now**.
 - It re-syncs automatically every time the page loads.
 - Achievements you already own get a `STEAM ✓` badge and a blue edge, and are counted as done.
 - Use the **⬇ Missing on Steam** filter on the Achievements tab to see only what is left.
-- Your profile is pre-filled. Clear it with **Forget profile**.
+- No profile is pre-filled in the public repo — type yours on the Steam Sync tab once and it is remembered in this browser.
 
 **If it fails,** the page tells you why. The usual cause is a private profile:
 Steam → your profile → **Edit Profile → Privacy Settings → Game details → Public**.
diff --git a/index.html b/index.html
index c028dd1..3855eae 100644
--- a/index.html
+++ b/index.html
@@ -486,8 +486,10 @@ const BIGBOSS      = {"intro":"Three hours, no rations, no kills, no radar, no s
    STATE
    ============================================================ */
 const KEY = 'mgs2mc-guide-v1';
-/* Pre-filled so the page syncs itself on first load. Clear it with "Forget profile". */
-const DEFAULT_PROFILE = 'mrmelonbread';
+/* Optional: a Steam vanity name or SteamID64 to sync on first load.
+   Left empty in the public repo - type your own on the Steam Sync tab instead.
+   (Anyone still running a local copy keeps their saved profile in localStorage.) */
+const DEFAULT_PROFILE = '';
 /* Live Steam sync needs a server (Steam sends no CORS headers). Leave this empty when running
    locally next to steam-sync.py. If you host this page on GitHub Pages / Netlify / Cloudflare,
    deploy steam-proxy-worker.js and paste its URL here to get sync back. */
diff --git a/steam-proxy-worker.js b/steam-proxy-worker.js
index ac37056..a423b8d 100644
--- a/steam-proxy-worker.js
+++ b/steam-proxy-worker.js
@@ -18,15 +18,15 @@
  *   4. In index.html, set:   const STEAM_PROXY = 'https://mgs2-steam-proxy.YOURNAME.workers.dev';
  *   5. Done — the page will use it automatically when it is not running on localhost.
  *
- * Optional: change ALLOW_ORIGIN below from '*' to your page's origin to stop anyone else
- * pointing their own page at your Worker.
+ * ALLOW_ORIGIN below is already pinned to the deploying page's origin, so nobody else
+ * can point their own page at this Worker. Add more origins to the list if you need to.
  *
  * The Worker makes exactly one outbound request, to the public Steam Community page for the
  * profile it is asked about. It stores nothing and logs nothing.
  */
 
 const APPID = '2131640';
-const ALLOW_ORIGIN = '*';        // e.g. 'https://yourname.github.io'
+const ALLOW_ORIGIN = 'https://rain.pages.melonbread.xyz';   // only this page may call the Worker
 const UA = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36';
 
 function cors(res) {