Security and CSP

Origin allowlist#

Embedding fails closed unless the site is published, embedding is enabled, and the browser's exact parent origin is allowed. An origin is scheme://hostname[:port]; paths and query strings are not part of it.

Add production, preview, and local origins separately. Do not add a wildcard to solve an installation error: anyone who copies a public slug could otherwise embed the agent and consume the site's credits.

Content Security Policy#

The loader needs script permission, the widget needs frame permission, and the loader's appearance request may need connection permission. Merge these sources into the host's existing directives; do not replace a mature policy with this minimal example.

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://makeagent.fast;
  frame-src https://makeagent.fast;
  connect-src 'self' https://makeagent.fast;

If the site uses script-src-elem, add https://makeagent.fast there too. The external loader does not require unsafe-inline, but the host's own framework may have separate nonce or hash requirements. A report-only policy is useful while testing:

Content-Security-Policy-Report-Only:
  script-src 'self' https://makeagent.fast;
  frame-src https://makeagent.fast;
  connect-src 'self' https://makeagent.fast;

When a browser console reports a CSP violation, change the named directive—not default-src broadly—and retest the public page.

Microphone and browser permissions#

The loader creates the iframe with allow="microphone; autoplay; clipboard-write". A stricter host-level Permissions Policy can still override that permission. If voice is enabled, permit the Make Agent Fast frame origin in the host response:

Permissions-Policy: microphone=(self "https://makeagent.fast")

The visitor must also grant microphone access in the browser. Test from HTTPS; browsers normally restrict microphone access on insecure public origins. Text chat does not require microphone permission.

Message and frame boundary#

The loader accepts only maf:ready, maf:open, maf:close, and theme lifecycle messages associated with the current site slug. Incoming frame messages are checked against https://makeagent.fast. Do not copy the loader into your own bundle or remove this origin validation.

Host-page code should not attempt to reach into the iframe DOM. The frame is cross-origin by design, and the supported integration surface is the loader plus its documented data-* attributes.

Secrets and visitor identity#

The site slug and loader URL are public. Everything else stays out of the page source:

• Never add a MAF API key, OAuth token, AI-provider key, connector token, or webhook secret to the snippet.
• Never build a secret into a JavaScript bundle or expose it through NEXT_PUBLIC_*, VITE_*, or similar browser environment variables.
• Use a server-side API integration when your application must create sites, update agents, or retrieve private workspace data.
• Do not place email addresses, account IDs, or other visitor data in data-label, data-locale, or query parameters.

Consent, privacy, and retention#

Classify the embed according to your privacy and consent policy. If your consent manager blocks nonessential third-party scripts, load embed.js only after the relevant consent. Until then, show a normal link or a disabled placeholder rather than bypassing the manager.

Tell visitors when the experience uses AI, microphone recording, lead capture, analytics, or an external messaging provider as required by your policy and applicable law. Confirm your site's conversation retention and deletion workflow before launch; disconnecting or removing the embed does not by itself delete existing conversations.

Security launch checklist#

• The production site and agent are published and tested.
• Only exact, intended parent origins are allowlisted.
• The host CSP permits the script, frame, and appearance request without broad wildcards.
• Microphone is permitted only if voice is enabled and has been tested over HTTPS.
• No credential or private visitor value appears in HTML, bundle output, or browser logs.
• Consent-manager behavior is tested before and after consent.
• A copied snippet fails on an origin that is not in the allowlist.