> For the complete documentation index, see [llms.txt](https://docs.checklist.getalvis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.checklist.getalvis.com/content-security-policy.md).

# Content Security Policy

**Content Security Policy** ([CSP](https://developer.mozilla.org/en-US/docs/Glossary/CSP)) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)) and data injection attacks. (Source: [Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP))

If you are using source allowlisting, use the following for Content Security Policy:

```
style-src:
  'unsafe-inline'
  https://fonts.googleapis.com
font-src:
  https://fonts.gstatic.com
connect-src:
  https://checklist.api.getalvis.com
child-src:
  https://onboarding-widget.getalvis.com
script-src:
  https://assets.getalvis.com
```

And, if you need to inject the script separately instead of including it in one of your scripts, you'll need to use `nonce`. (i.e. `script-src 'nonce-rAnd0m'` and `<script nonce="rAnd0m">`...)

If you cannot use the `nonce` method, you can only use the `hash` method.\
\
1. Go to Dashboard, click the top right corner and click Install, then copy the installation script.\
2. Paste into the place where you want to put the script. Then copy exactly what is between `<script>` and `</script>`, and put it into <https://report-uri.com/home/hash> to generate the hash.\
3. Add the generated `hash` to `script-src`.\
\
Also checkout how to [use Intercom with Content Security Policy](https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy).