# Content Security Policy

**Content Security Policy** ([CSP](https://developer.mozilla.org/en-US/docs/Glossary/CSP)) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)) and data injection attacks. (Source: [Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP))

If you are using source allowlisting, use the following for Content Security Policy:

```
style-src:
  'unsafe-inline'
  https://fonts.googleapis.com
font-src:
  https://fonts.gstatic.com
connect-src:
  https://checklist.api.getalvis.com
child-src:
  https://onboarding-widget.getalvis.com
script-src:
  https://assets.getalvis.com
```

And, if you need to inject the script separately instead of including it in one of your scripts, you'll need to use `nonce`. (i.e. `script-src 'nonce-rAnd0m'` and `<script nonce="rAnd0m">`...)

If you cannot use the `nonce` method, you can only use the `hash` method.\
\
1. Go to Dashboard, click the top right corner and click Install, then copy the installation script.\
2. Paste into the place where you want to put the script. Then copy exactly what is between `<script>` and `</script>`, and put it into <https://report-uri.com/home/hash> to generate the hash.\
3. Add the generated `hash` to `script-src`.\
\
Also checkout how to [use Intercom with Content Security Policy](https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.checklist.getalvis.com/content-security-policy.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.