For the complete documentation index, see llms.txt
Saltar al contenido principal

Production checklist

Confirm these security measures before deploying the PushFeedback widget to production.

For widget integrations​

Widget Integrations Only

The following steps apply only to implementations using the feedback widget.

  • Restrict allowed domains: Set your site's Website URL under Projects > your project > Settings > Project details. On Unlimited, use Add more to configure additional URLs. Submissions are accepted only from the configured hostnames.

  • Enable two-factor authentication (2FA): Navigate to My account > Profile and enable 2FA for all accounts with access to the dashboard to enhance access security.

  • Configure data privacy (optional): Choose whether to show the privacy consent checkbox with hide-privacy-policy, and set your policy text with privacy-policy-text. For more information, see Layout customization.

For API integrations​

API Integrations Only

The following steps apply only to direct integrations using the PushFeedback REST API. These steps are not necessary for widget-based implementations.

  • Authenticate with an API key: Ensure each authenticated API request includes an API key in the header as follows: Authorization: Api-Key <token>.

  • Grant least-privilege scopes: Give each API key only the scopes its integration needs (feedback:read, feedback:submit, or project:manage), and restrict it to a single project where possible. See API key security.

  • Set up regular API keys rotation: Establish a schedule for rotating API keys periodically to enhance security.

  • Verify token security: Confirm that tokens are not publicly accessible (e.g., in repositories) and are shared only with authorized team members.

  • Use secure API key storage: Store API keys in environment variables, encrypted configuration files, or dedicated secrets management systems (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault). Never hardcode keys in your application code or commit them to version control.

  • Deactivate unused tokens: Immediately disable any tokens that are no longer in use to prevent unauthorized access.