> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.screeb.app/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Using Screeb with Content Security Policy

You want to display Screeb surveys while being sure your app is secured and protected against injection attacks. Here's how to make Screeb compatible with your Content Security Policy (CSP).

# Good news: no `unsafe-inline`, no `unsafe-eval`

Screeb's tag runs cleanly under a strict CSP: it needs **no `'unsafe-inline'`, no `'unsafe-eval'`, no `prefetch-src`, and no `font-src blob:`**. Those used to be required by older tag versions but are no longer needed (fonts moved to the Font Loading API, and no bundle injects inline scripts or styles anymore).

# Directives to allow

Rather than a single catch-all `default-src`, allow Screeb per directive:

```
default-src 'self';
script-src 'self' https://*.screeb.app;
connect-src 'self' https://*.screeb.app wss://*.screeb.app https://*.s3.fr-par.scw.cloud;
style-src 'self' https://*.screeb.app;
img-src 'self' data: blob: https://*.screeb.app;
font-src 'self' https://*.screeb.app;
media-src 'self' blob: https://*.screeb.app;
frame-src 'self';
```

And don't forget to keep your own domains alongside these.

# Why each domain is there

* `https://*.screeb.app` covers the tag's loader, bundles, CSS, webfonts, translations, sounds and emoji, the real-time API, and error reporting.
* `wss://*.screeb.app` is the WebSocket channel used for real-time communication.
* `https://*.s3.fr-par.scw.cloud` is required separately: file, voice, video and screenshot answers upload directly to a pre-signed URL on Screeb's object storage, which is **not** covered by `*.screeb.app`.

# An example

If you already allow `admin.example.com` and `vip.example.com`, your policy becomes:

```
content-security-policy: default-src 'self'; script-src 'self' https://*.screeb.app; connect-src 'self' https://*.screeb.app wss://*.screeb.app https://*.s3.fr-par.scw.cloud; style-src 'self' https://*.screeb.app; img-src 'self' data: blob: https://*.screeb.app; font-src 'self' https://*.screeb.app; media-src 'self' blob: https://*.screeb.app; frame-src 'self'; object-src 'self'; report-uri /csp-violation-report; frame-ancestors 'self' https://admin.example.com https://vip.example.com
```

## Questions of type "Calendar"

Screeb allows its users to create a question of type **Calendar**, to invite users to book a meeting. Many tools can be used, such as **Calendly**, **Google Appointments**...

[![](https://storage.crisp.chat/users/helpdesk/website/-/a/a/3/5/aa357cd72a4c3800/d85ef6b6-7474-4ba0-9a66-41a28b_1ahrz0r.png)](https://downloads.intercomcdn.com/i/o/1060915451/075129debf403f8284e08798/image.png?expires=1767194100&signature=49441233e59ff57ccea66bfa205212708ac7eb68ab021f7b895c2b88673487c4&req=dSAhFsB%2FmIVaWPMW1HO4zeoyFmP0%2BMCuN1V0A5ThHSX7a6%2Fhx4sOovTJu06P%0AzvuFzMhU%2FlGdh910Ncg%3D%0A)

This feature opens an iframe in your web app during the survey. If so, please authorize the domain of your third-party application in `frame-src` (in addition to `'self'`):

* SavvyCal: [https://savvycal.com](https://savvycal.com)
* Cal: [https://cal.com](https://cal.com)
* Hubspot: [https://meetings.hubspot.com](https://meetings.hubspot.com)
* Google Appointments: [https://calendar.google.com](https://calendar.google.com)

### Example:

```
frame-src 'self' https://calendar.google.com
```