Fix: Default permissions is public
Fix CORS