Content Security Policy

If your site sends a Content-Security-Policy, add the hosts below. The tracking SDK needs its own two entries.

Messenger and support form

Add the widget host to these directives. Without them the browser blocks the widget and nothing shows.

Directive	Add	Why
script-src	https://widget.customercatalyst.io	Loads messenger.js / form.js.
connect-src	https://widget.customercatalyst.io	Settings, sending, conversations and file downloads.
frame-src	https://widget.customercatalyst.io	The security check runs in a small frame on our host.
style-src	'unsafe-inline'	The widgets bring their styles as a <style> element inside their Shadow DOM.
img-src	data:, and your logo’s host, e.g. https://*.cdn.bubble.io	data: draws the arrow on list fields. The logo host only if you set a logo; logos uploaded in CustomerCatalyst are served from Bubble’s file storage.

For example:

Content-Security-Policy:
  script-src 'self' https://widget.customercatalyst.io;
  connect-src 'self' https://widget.customercatalyst.io;
  frame-src https://widget.customercatalyst.io;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https://*.cdn.bubble.io

Merge these into your existing policy rather than replacing it.

Cloudflare Turnstile

The Turnstile security check loads from https://challenges.cloudflare.com, but inside our own frame on widget.customercatalyst.io, which has its own policy. Your page doesn’t load anything from challenges.cloudflare.com, so your policy doesn’t need it.

Fonts

The widgets load no web fonts. With Inter chosen, they use Inter when the visitor’s device has it.

Tracking SDK

customercatalyst.js loads from our CDN and sends events to the CustomerCatalyst API host, with fetch and, when the page is hidden or closed, navigator.sendBeacon. Both are covered by connect-src.

Directive	Add	Why
script-src	https://cdn.customercatalyst.io	Loads customercatalyst.js.
connect-src	https://xfjgmzwigomtfmaloeun.supabase.co	Sends events.

The tracking script loads no styles, fonts or frames.