Access and data

Your feedback. Clear boundaries.

Understand who can read a project, how files are shared, and what runs on your website.

Report a security issue Privacy notice

Member access

Project keys do not replace sign-in or team membership.

Private files

Uploads use private storage and expiring download links.

Context you choose

Review screenshots and agent exports before sharing them.

Project keys and browser access

Each project has an API key and a list of allowed hostnames. Browser requests must match that list, so add production, staging and local hosts deliberately.

A project key is visible in your website’s browser code.

The hosted service requires a signed-in team member to read or change project comments. A project key alone does not grant that access. Allowed hostnames restrict browser origins; they do not replace user authentication.

Rotating a project key stops the previous key from working immediately. Update each installation after rotating it.

Invite the right people

Member invitations are tied to an email address. The widget asks the invited person to verify that address with a one-time code before signing in and commenting.

An invitation grants team membership. Check the recipient and the workspace before sharing it. Expired, inactive or already accepted member invite links cannot be reused.

Before sharing a review

Check the project and website the link belongs to.
Use the intended recipient’s email address.
Check the invitation’s expiry and status.
Review team membership when the work is finished.

Choose what you share

Comments can contain page URLs, element details, attachments and screenshots. Check the page and its visible data before capturing or sharing feedback.

The built-in screenshot capture excludes password inputs and elements marked with data-commentkit-redact. A custom screenshot provider must apply its own redaction rules.

Agent exports are copied on your request. Review their contents before pasting them into another tool.

Attachment access

Uploaded files use private storage. After an authorized request, CommentKit returns a download link that expires after 15 minutes. Each download rechecks the issuing member’s access and whether the file and its thread still exist.

Anyone holding a valid download link can use it until it expires or access is revoked. Treat these links as private when sharing feedback or an agent export. Refresh an expired preview in the widget to request a new link.

A separate space to try the real package

Starting the playground creates a temporary identity in an isolated project. It cannot access customer projects. Comments and private uploads are stored on our servers so you can try actual replies, reactions, annotations and live collaboration. No email address or signup is required.

The creator can share a one-use invitation with one other person. Access ends for everyone two hours after creation, with scheduled cleanup removing the expired content. Reset deletes the active playground sooner; Hide keeps it available to the same browser. Playground tokens and offline edits stay in memory.

Limits apply to sessions, writes and uploads. The browser receives a short-lived token restricted to its playground, while the website session can restore that access. Treat invitations and downloaded files as private, and use sample feedback rather than sensitive information. Read the playground privacy details.

Protect the host page

CommentKit runs inside your website. Shadow DOM keeps styles separate, but it is not a security boundary for JavaScript. Keep your app and its dependencies maintained.

For a custom API endpoint, use HTTPS in production. Never place server credentials in your widget configuration.

Read the setup guide

Report a concern

Email [email protected] with the affected version, a description, and steps to reproduce the issue. Keep security reports private.

For account or data questions, contact support.