Security
What to verify before you ship. How to report a finding.
What integrators verify
| Check | Why |
|---|---|
| Domain allowlist | Stops other sites from embedding your widget |
| API keys stay server-side | Public agent ID is fine in the browser. Secrets are not |
| Org-scoped keys | A key only touches one organization's agents and tickets |
| Hashed visitor IDs | Identify without sending raw PII |
Report a vulnerability
Email dev@humaner.io with reproduction steps. We will get back to you as soon as possible. Do not file public issues for exploitable findings.
Chat data
Messages and tickets are saved in your DB. Set MESSAGE_RETENTION_DAYS and own privacy settings.