Security boundary

Ship code that cannot change behind review.

Textxt treats Mini App content as untrusted. Every executable resource must stay on one public HTTPS origin, pass policy checks, and reproduce the archived digest at approval and during health monitoring.

Required release profile

Versioned URL

startUrl must contain the exact semantic version in its path or query. Never overwrite files under a released version.

https://apps.example.com/my-app/v1.4.0/index.html

Same-origin code

HTML, JavaScript, CSS, module imports, and executable preloads must use the startUrl origin. Bundle framework and SDK files with the release.

Public network only

DNS and every redirect are checked. Localhost, private, link-local, reserved, internal, and metadata service addresses are rejected.

Strict iframe policy

Send CSP as an HTTP response header. A meta tag cannot provide frame-ancestors. Do not send X-Frame-Options: DENY or SAMEORIGIN.

Minimum CSP header

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src https://api.example.com; frame-ancestors https://textxt.com https://textxt-14209.web.app; object-src 'none'; base-uri 'none'; form-action 'self'

External script hosts, wildcard script sources, data: scripts, unsafe-eval, wasm-unsafe-eval, base tags, service-worker registration, embedded private keys, and known obfuscation/miner patterns fail automated verification.

Hosting examples

Firebase Hosting

{
  "headers": [{
    "source": "/my-app/v1.4.0/**",
    "headers": [{
      "key": "Content-Security-Policy",
      "value": "default-src 'self'; script-src 'self'; frame-ancestors https://textxt.com https://textxt-14209.web.app; object-src 'none'; base-uri 'none'"
    }]
  }]
}

Nginx

location /my-app/v1.4.0/ {
  add_header Content-Security-Policy
    "default-src 'self'; script-src 'self'; frame-ancestors https://textxt.com https://textxt-14209.web.app; object-src 'none'; base-uri 'none'" always;
}

Runtime expectations

Use the hosted SDK and Bridge feature detection. Do not trust correlation session fields as authentication.
Handle permission denial, offline state, timeouts, rate limits, session expiry, and duplicate retries.
Call bridge.reportError({ name, message }) for recoverable failures. Unhandled iframe/WebView and Bridge failures are also counted by Textxt.
Do not persist chat context beyond your documented purpose. Never log secrets, message bodies, access tokens, or personal data in telemetry.

Report a vulnerability: create a critical security ticket from Developer Console. Include the affected app or Textxt surface, impact, reproduction steps, and a safe proof of concept. Do not access other users' data or publish details before remediation.