diff --git a/package.json b/package.json
index 09e1cc3..44203ca 100644
--- a/package.json
+++ b/package.json
@@ -4,8 +4,8 @@
   "description": "Starter project for an ES6 RESTful Express API",
   "main": "dist",
   "scripts": {
-    "dev": "nodemon -w src --exec \"babel-node src\"",
-    "build": "npx babel src -d dist",
+    "dev": "NODE_ENV=development nodemon -w src --exec \"babel-node src\"",
+    "build": "NODE_ENV=production npx babel src -d dist",
     "start": "node dist",
     "lint": "standard \"src/**/*.js\" \"test/**/*/js\"",
     "test-watch": "ava --watch",
@@ -20,7 +20,7 @@
   "dependencies": {
     "body-parser": "^1.13.3",
     "compression": "^1.5.2",
-    "cors": "^2.7.1",
+    "cors": "^2.8.5",
     "express": "^4.13.3",
     "express-graphql": "^0.6.12",
     "googleapis": "^32.0.0",
diff --git a/src/index.js b/src/index.js
index c5fe1d6..c2a483b 100755
--- a/src/index.js
+++ b/src/index.js
@@ -8,6 +8,13 @@ import config from './config'
 let app = express()
 app.server = http.createServer(app)
 
+// enable cross origin requests explicitly in development
+if (process.env.NODE_ENV === 'development') {
+  const cors = require('cors')
+  console.log('Enabling CORS in development...')
+  app.use(cors())
+}
+
 initialize(controller => {
   app.use(
     middleware({
diff --git a/yarn.lock b/yarn.lock
index 3e80443..28e1cac 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1267,9 +1267,9 @@ core-util-is@~1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
 
-cors@^2.7.1:
-  version "2.8.4"
-  resolved "https://registry.yarnpkg.com/cors/-/cors-2.8.4.tgz#2bd381f2eb201020105cd50ea59da63090694686"
+cors@^2.8.5:
+  version "2.8.5"
+  resolved "https://registry.yarnpkg.com/cors/-/cors-2.8.5.tgz#eac11da51592dd86b9f06f6e7ac293b3df875d29"
   dependencies:
     object-assign "^4"
     vary "^1"