Answers about security
Questions and answers from the Croct community about security.
14
Does Croct work under a strict Content-Security-Policy?
We run a strict CSP, no unsafe-inline anywhere. The last visual testing tool we evaluated required inline script injection for its variants, which would have…
0
After moving Croct behind our own domain, what CSP directives are still needed?
We recently completed a first-party proxying rollout for Croct requests, using the baseEndpointUrl and cidAssignerEndpointUrl options to route SDK traffic…
0
CROCT_API_KEY ended up in a shared log, how do I rotate it without downtime?
On 2026-06-16 we found CROCT_API_KEY printed in a CI log from a debug step added in April. The log is internal but shared across teams, so per our policy the…
0
Security review wants shorter-lived user tokens, what does CROCT_TOKEN_DURATION control?
Hello, our internal audit flagged all long-lived authentication artifacts in the stack, and the Croct user token came up in the list. Before I change anything…