Security

On the bot’s Setup tab, list your sites under Allowed domains, separated by commas or new lines:

docs.acme.com, *.acme.com

docs.acme.com allows exactly that host.
*.acme.com allows every subdomain of acme.com, but not acme.com itself.
Ports and http or https do not matter.

The widget refuses to answer on any other site, and a bot with no allowed domains answers nowhere. The check uses the browser’s Origin header, which stops other websites from using your widget. Scripts outside a browser can fake that header, which is why rate limits and Turnstile also apply.

Rate limits

Chat messages are limited per visitor IP (20 a minute), per visitor (10 a minute), and per bot (120 a minute). Handoff requests have stricter limits. You can change the chat limits with the settings in Configuration.

Turnstile

Set TURNSTILE_SITE_KEY and TURNSTILE_SECRET to require a Cloudflare Turnstile check at the start of every conversation. A token solved on a site that is not in the bot’s allowed domains is rejected.

Untrusted content

Crawled pages are data, never instructions. Page text reaches the model inside escaped, clearly marked blocks, and the model is told never to follow instructions found there. It has no tools and no access to secrets.
Answers are checked. Every citation must point to a page the bot actually retrieved, and answers are stripped of images and of links to sites other than yours, so a poisoned page cannot send visitors elsewhere.
No requests to internal addresses. Every fetch of a URL you or your content supply, including crawling, brand extraction, and Slack webhooks, blocks private, loopback, link-local, and cloud metadata addresses, including through redirects and DNS.

Secrets

Secrets are read from Worker bindings only and are never logged. API keys for the admin API are stored hashed and shown once. The Slack webhook URL is never shown again after you save it.

Reporting a vulnerability

Please email security@getanswerkit.com rather than opening a public issue.