Content Security Policy

The snippet needs two allowances in your Content Security Policy. Replace the host with your TraceLead origin or CDN host.

script-src  'self' https://app.tracelead.io;
connect-src 'self' https://app.tracelead.io;

• script-src lets the browser load /snippet/v1/tracelead.js.
• connect-src lets it fetch the public configuration (GET /api/config/<site id>) and, after consent, send session and lead beacons (POST /api/collect). Beacons go through navigator.sendBeacon, which is governed by connect-src.

No style-src, img-src or frame-src entries are required: the snippet creates no elements, loads no images and uses no frames.

Inline consent stub#

The optional stub that queues calls before the script loads is inline JavaScript:

<script>
window.tracelead = window.tracelead || function () { (window.tracelead.q = window.tracelead.q || []).push(arguments); };
</script>

If your policy disallows inline scripts, either add a nonce or hash for it, or move it into a file you already serve. The stub is not required when you call tracelead(...) only after the snippet has loaded.

Subresource integrity#

Each snippet release publishes manifest.json next to the script with its SHA-256 hash. If you pin an integrity attribute, remember to update it when you move to a new version; the versioned path (/snippet/v1/) only changes on breaking releases.