diff --git a/src/lib/security/http.ts b/src/lib/security/http.ts
index ad6c0cb3..b384e2ea 100644
--- a/src/lib/security/http.ts
+++ b/src/lib/security/http.ts
@@ -39,7 +39,7 @@ export function assertSameOrigin(req: Request): GuardResult {
   if (origin) {
     try {
       const o = new URL(origin);
-      const ok = [...allowed].some((a) => {
+      const ok = Array.from(allowed).some((a) => {
         try {
           const u = new URL(a);
           return u.host === o.host;
@@ -94,4 +94,4 @@ export function guardExpensivePost(req: Request, keyPrefix = "api"): GuardResult
 /** Test helper — clear rate-limit buckets between unit tests. */
 export function __resetRateLimitBucketsForTests(): void {
   buckets.clear();
-}
+}
\ No newline at end of file