Security and privacy

What visitors download

Every visitor of a site with the line loads a script of under 1 KB. It makes no network request and stores nothing unless this browser has signed in to EkhaneMark on the site, or the address ends in #ekhanemark. The full widget loads only then.

What a script tag can do

Like any script from another domain (analytics, chat, ads), w.js runs with the same rights as the site's own code: it could read the page, what people type and the site's cookies that aren't HttpOnly. EkhaneMark's widget doesn't: it only draws its own interface, records what the person giving feedback adds, and takes the screenshot described below. Comments, names and file names are always shown as text, never as HTML, so a comment with code in it can't run on your site.

The real risk is the server the script comes from. If someone took over the EkhaneMark server, they could change w.js, and every site that loads it would run their code. That's true of every third-party script, and it's why we recommend:

• Keep the line off the live site and load it only on localhost and staging (how). Then live visitors download nothing from EkhaneMark, whatever happens to it.
• If the live site needs it, use Review mode. Visitors then never see the widget and it never starts for them. Note that the small loader is still downloaded by every visitor, so Review limits who uses EkhaneMark, not what the loader could do if the server were compromised.
• For full control, self-host (Self-hosting), so the script comes from a server you run.

Pinning the script with Subresource Integrity (an integrity hash in the tag) isn't supported yet: the loader fetches the widget as a second file, which the hash wouldn't cover.

Access

• Nobody gets in with a link alone. Everyone signs in to EkhaneMark (Google or email), and clients only after the team approves them.
• Signing in from the site (#ekhanemark) happens in an EkhaneMark window, which sends a signed token only to the project address that asked for it. Links in the dashboard and in emails carry no access.
• Every request must carry that token and come from an address of the project (or, for the team only, a localhost address). A copied project key or link does nothing on another website.
• Removing a client or a team member stops their access immediately.

What is stored

• The feedback text, voice notes, images and files people add.
• A screenshot of the visible part of the page. Password inputs, card fields and anything marked data-ekhanemark-private are blacked out first; everything else on screen is in it, so avoid pinning on pages that show other people's personal data, or mark those parts private.
• Page address, browser, operating system, screen size and language.
• The name and email of the person who left it.

Files are served only through signed links that expire. Jira API tokens are stored encrypted.

Self-hosting

For full control of the data, run EkhaneMark on your own server. See Self-hosting.