`N8N_POSTMESSAGE_ALLOWED_ORIGINS` empty by default → embedded editor accepts `postMessage` from any origin

Static review of public source at commit fe0fad574337. No traffic was sent to any n8n environment. The security config ships an empty postMessage allowlist, and the editor utils treat empty as "allow all": packages/@n8n/config/src/configs/security.config.ts: packages/frontend/editor-ui/src/app/utils/postMessageUtils.ts: (frontend.service.ts splits the env on , and filters empties, so the default '' becomes [].) Any parent page that can iframe a preview/demo embed can therefore drive editor postMessage commands until an operator sets N8N_POSTMESSAGE_ALLOWED_ORIGINS. The comment already calls this historical behavior; the remaining gap is the insecure default for new installs that enable embeds. Suggested change: • Default to same-origin only (or to APP_URL / editor origin), and treat empty as deny-by-default for new majors; or • Keep empty→allow for compatibility but emit a one-time admin warning when embeds are used with an empty allowlist; or …