Skip to main content

​
🔒 Security

  • Clickjacking protection for embedded published apps Published Data Apps and Agentic Apps are now protected against clickjacking by enforcing a Content Security Policy frame-ancestors directive derived from each workspace’s approved embed origins.
    • Added a frame-ancestors directive to responses served through the published app proxy, limiting embedding to 'self' and the origins registered for the app’s workspace
    • Added an embed-origins lookup endpoint that returns approved origins and propagation details for a workspace, with request coalescing, caching, timeouts, and safe fallbacks
    • Origin matching now supports exact, wildcard, and pattern-based entries so admins can allow entire subdomain trees or template-style origins
    • Default CORS access is restricted to approved domains and localhost, and the embed CORS bypass is disabled by default so the allow-list is always enforced
    • Added rate limiting for unauthenticated embed-origin lookups to prevent abuse of the public lookup endpoint