Context
The publishable/secret key model (#11) and origin validation shipped in the first campaign but have no rotation story and no documented Content-Security-Policy guidance for merchants embedding the widget — both of which a real security review will flag before production use.
Scope
- Key rotation flow: issue a new
sk_/pk_ pair without invalidating the old one until the merchant confirms cutover (grace period).
- Harden origin validation to cover wildcard/subdomain edge cases and reject malformed
Origin/Referer headers explicitly.
- Publish CSP + iframe-sandboxing guidance for merchants embedding
connect-elements, and add automated tests asserting the shipped widget respects those constraints.
Acceptance criteria
- Rotating a key does not break in-flight sessions using the old key during the grace period.
- A request with a spoofed or malformed origin is rejected with a clear error code, with a test covering the edge cases.
- Docs site includes a CSP snippet merchants can copy-paste, verified against the actual widget bundle.
Context
The publishable/secret key model (#11) and origin validation shipped in the first campaign but have no rotation story and no documented Content-Security-Policy guidance for merchants embedding the widget — both of which a real security review will flag before production use.
Scope
sk_/pk_pair without invalidating the old one until the merchant confirms cutover (grace period).Origin/Refererheaders explicitly.connect-elements, and add automated tests asserting the shipped widget respects those constraints.Acceptance criteria