> Frontend is HTML5 hosted on github pages, backend is Node.JS on GCP.

So this means it's doing CORS? Why not just have GCP serve everything?