You want to display Screeb surveys while being sure your app is secured and protected against injection attacks. Here's how to make Screeb compatible with your Content Security Policy (CSP).

Good news: no unsafe-inline, no unsafe-eval

Screeb's tag runs cleanly under a strict CSP: it needs no 'unsafe-inline', no 'unsafe-eval', no prefetch-src, and no font-src blob:. Those used to be required by older tag versions but are no longer needed (fonts moved to the Font Loading API, and no bundle injects inline scripts or styles anymore).

Directives to allow

Rather than a single catch-all default-src, allow Screeb per directive:

default-src 'self';
script-src 'self' https://*.screeb.app;
connect-src 'self' https://*.screeb.app wss://*.screeb.app https://*.s3.fr-par.scw.cloud;
style-src 'self' https://*.screeb.app;
img-src 'self' data: blob: https://*.screeb.app;
font-src 'self' https://*.screeb.app;
media-src 'self' blob: https://*.screeb.app;
frame-src 'self';

And don't forget to keep your own domains alongside these.

Why each domain is there

• https://*.screeb.app covers the tag's loader, bundles, CSS, webfonts, translations, sounds and emoji, the real-time API, and error reporting.
• wss://*.screeb.app is the WebSocket channel used for real-time communication.
• https://*.s3.fr-par.scw.cloud is required separately: file, voice, video and screenshot answers upload directly to a pre-signed URL on Screeb's object storage, which is not covered by *.screeb.app.

An example

If you already allow admin.example.com and vip.example.com, your policy becomes:

content-security-policy: default-src 'self'; script-src 'self' https://*.screeb.app; connect-src 'self' https://*.screeb.app wss://*.screeb.app https://*.s3.fr-par.scw.cloud; style-src 'self' https://*.screeb.app; img-src 'self' data: blob: https://*.screeb.app; font-src 'self' https://*.screeb.app; media-src 'self' blob: https://*.screeb.app; frame-src 'self'; object-src 'self'; report-uri /csp-violation-report; frame-ancestors 'self' https://admin.example.com https://vip.example.com

Questions of type "Calendar"

Screeb allows its users to create a question of type Calendar, to invite users to book a meeting. Many tools can be used, such as Calendly, Google Appointments...

This feature opens an iframe in your web app during the survey. If so, please authorize the domain of your third-party application in frame-src (in addition to 'self'):

• SavvyCal: https://savvycal.com
• Cal: https://cal.com
• Hubspot: https://meetings.hubspot.com
• Google Appointments: https://calendar.google.com

Example:

frame-src 'self' https://calendar.google.com

Updated on: 27/08/2026