diff --git a/index.js b/index.js
index 315bd3bf5..7379322e8 100644
--- a/index.js
+++ b/index.js
@@ -1,5 +1,3 @@
-const Path = require('path')
-module.exports = {}
 const optionDefinitions = [
   { name: 'config', alias: 'c', type: String },
   { name: 'metadata', alias: 'm', type: String },
@@ -14,6 +12,7 @@ const optionDefinitions = [
 const commandLineArgs = require('./server/libs/commandLineArgs')
 const options = commandLineArgs(optionDefinitions)
 
+const Path = require('path')
 process.env.NODE_ENV = options.dev ? 'development' : process.env.NODE_ENV || 'production'
 
 const server = require('./server/Server')
@@ -32,8 +31,6 @@ if (isDev || options['prod-with-dev-env']) {
   if (devEnv.AllowIframe) process.env.ALLOW_IFRAME = '1'
   if (devEnv.BackupPath) process.env.BACKUP_PATH = devEnv.BackupPath
   if (devEnv.ReactClientPath) process.env.REACT_CLIENT_PATH = devEnv.ReactClientPath
-  if (devEnv.RouterBasePath !== undefined) process.env.ROUTER_BASE_PATH = devEnv.RouterBasePath
-  if (devEnv.RecommendationsEnabled) process.env.RECOMMENDATIONS_ENABLED = 'true'
   process.env.SOURCE = 'local'
   process.env.ROUTER_BASE_PATH = devEnv.RouterBasePath ?? '/audiobookshelf'
 }
diff --git a/server/Server.js b/server/Server.js
index 28ea52a94..457aa61ab 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -38,7 +38,7 @@ const ApiCacheManager = require('./managers/ApiCacheManager')
 const BinaryManager = require('./managers/BinaryManager')
 const ShareManager = require('./managers/ShareManager')
 const LibraryScanner = require('./scanner/LibraryScanner')
-const buildRecommendationsRouter = require('./routers/recommendations')
+
 //Import the main Passport and Express-Session library
 const passport = require('passport')
 const expressSession = require('express-session')
@@ -229,6 +229,10 @@ class Server {
         res.setHeader('Content-Security-Policy', "frame-ancestors 'self'")
       }
 
+      // Security: Prevent referrer leakage to protect against token exposure
+      // Using 'no-referrer' to completely prevent token leakage in referer headers
+      res.setHeader('Referrer-Policy', 'no-referrer')
+
       /**
        * @temporary
        * This is necessary for the ebook & cover API endpoint in the mobile apps
@@ -240,8 +244,8 @@ class Server {
        * Running in development allows cors to allow testing the mobile apps in the browser
        * or env variable ALLOW_CORS = '1'
        */
-      if (global.AllowCors || Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/)) {
-        const allowedOrigins = ['capacitor://localhost', 'http://localhost']
+      if (global.AllowCors || Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/) || global.ServerSettings.allowedOrigins?.length) {
+        const allowedOrigins = ['capacitor://localhost', 'http://localhost', ...(global.ServerSettings.allowedOrigins ? global.ServerSettings.allowedOrigins : [])]
         if (global.AllowCors || Logger.isDev || allowedOrigins.some((o) => o === req.get('origin'))) {
           res.header('Access-Control-Allow-Origin', req.get('origin'))
           res.header('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, DELETE, OPTIONS')
@@ -317,8 +321,6 @@ class Server {
     // Static folder
     router.use(express.static(Path.join(global.appRoot, 'static')))
 
-    router.use('/api/recommendations', this.auth.ifAuthNeeded(this.authMiddleware.bind(this)), buildRecommendationsRouter(this.auth))
-
     // RSS Feed temp route
     router.get('/feed/:slug', (req, res) => {
       Logger.info(`[Server] Requesting rss feed ${req.params.slug}`)
diff --git a/server/migrations/2024092401-create-book-recommendations.js b/server/migrations/2024092401-create-book-recommendations.js
deleted file mode 100644
index a37471713..000000000
--- a/server/migrations/2024092401-create-book-recommendations.js
+++ /dev/null
@@ -1,22 +0,0 @@
-'use strict'
-module.exports = {
-  up: async (qi, Sequelize) => {
-    await qi.createTable('book_recommendations', {
-      id: { type: Sequelize.INTEGER, primaryKey: true, autoIncrement: true },
-      bookId: { type: Sequelize.STRING, allowNull: false },
-      recommenderUserId: { type: Sequelize.STRING, allowNull: false }, // string user id
-      recipientUserId: { type: Sequelize.STRING, allowNull: true }, // string user id
-      tagId: { type: Sequelize.INTEGER, allowNull: false },
-      note: { type: Sequelize.TEXT, allowNull: true },
-      visibility: { type: Sequelize.ENUM('public', 'recipient-only'), allowNull: false, defaultValue: 'public' },
-      createdAt: { type: Sequelize.DATE, allowNull: false, defaultValue: Sequelize.fn('NOW') },
-      updatedAt: { type: Sequelize.DATE, allowNull: false, defaultValue: Sequelize.fn('NOW') }
-    })
-    await qi.addIndex('book_recommendations', ['bookId', 'tagId'])
-    await qi.addIndex('book_recommendations', ['recipientUserId'])
-    await qi.addIndex('book_recommendations', ['recommenderUserId', 'createdAt'])
-  },
-  down: async (qi) => {
-    await qi.dropTable('book_recommendations')
-  }
-}