Security issues with having an array of allowed origins for iFrame?

Currently I have a couple environments of the same URL that should be allowed to listen to the postMessage and the issue I have is that these URLs are exposed in the index.html and was wondering is there any issues with doing this? Any suggestions on handling this?

Ex:

const allowedURL = ["https://dev.test.com", "https://stg.test.com",..]

window.addEventListener( function(event) {
if(allowedURL.includes(event.origin)){ return } });