Security
Production Security Best Practices
Master production readiness checklist: Content Security Policy (CSP), key rotation, Origin whitelists, and monitoring.
Overview
Before directing enterprise traffic to pages with the embedded Asiyst assistant, complete this hardening checklist to ensure maximum security, privacy, and performance.
Production Readiness Checklist
| Category | Verification Item | Status |
|---|---|---|
| Credentials | Use pk_live_ public keys only; zero secret keys in client bundles | Required |
| Whitelists | Remove http://localhost and wildcards from production Allowed Domains | Required |
| CSP | Add https://cdn.asiyst.com and wss://api.asiyst.com to Content-Security-Policy | Required |
| Sessions | Implement Asiyst.logout() on user sign-out | Required |
| Alerts | Configure Slack / PagerDuty webhook for error rate spikes | Recommended |
| Retention | Set conversation data retention window (e.g. 90 days) | Recommended |
Content Security Policy (CSP) Directives
If your website enforces strict CSP headers, include these directives:
Content-Security-Policy:
default-src 'self';
script-src 'self' https://cdn.asiyst.com;
connect-src 'self' https://api.asiyst.com wss://api.asiyst.com https://cdn.asiyst.com;
img-src 'self' data: https://cdn.asiyst.com;
style-src 'self' 'unsafe-inline';
Monitoring & Incident Response
- Monitor 403 Origin rejections in the Analytics > Errors tab.
- Maintain a dedicated security contact email under Account Settings > Security Contact.