Executive Summary
Modern enterprise AI website chatbots face serious security vulnerabilities when deployed via client-side JavaScript tags. Traditional implementations expose static API tokens, allow unauthorized host domains to hijack agent quotas, and fail to prevent unauthorized parties from accessing sensitive Retrieval-Augmented Generation (RAG) knowledge vectors.
Let's Chat solves this with a multi-tier Zero-Trust Platform Defense Architecture, enforcing cryptographic DNS ownership verification, strict HTTP Origin header attestation, short-lived ephemeral JWT session credentials, and sub-5ms global kill-switch revocation—guaranteeing 0 bytes of corporate knowledge exfiltration to untrusted origins.
1. Threat Landscape for Embeddable Autonomous Agents
Autonomous web agents possess direct integrations into enterprise CRMs, product databases, and meeting schedulers. Exposing these capabilities to the open internet introduces three primary attack vectors:
Copied Snippet Hijacking
Competitors or phishing sites copy the <script> embed tag to their own domain, stealing agent reasoning and draining LLM API tokens.
OWASP LLM06 Exfiltration
Malicious origins query the chatbot with prompt injections to systematically extract internal RAG knowledge vectors and confidential pricing formulas.
Stolen Deployment Key
Leaked deployment IDs used in rogue scrapers or automated bot swarms without real-time revocation mechanisms.
2. Four Pillars of Let's Chat Zero-Trust Defense
1
Pillar 1: Cryptographic Domain Anchoring (DNS TXT Verification)
Before an agent can be configured, domain ownership is attested using automated Namecheap DNS API or manual TXT challenge records (letschat-site-verification=<token>). Agents can only be assigned to domains proven under cryptographic control of the workspace owner.
2
Pillar 2: Edge Handshake & Ephemeral Scoped JWT Minting
The client loader initiates an attestation handshake via POST /api/bootstrap. The Let's Chat edge gateway strictly validates HTTP Origin and Referer headers against the whitelisted domain. If valid, an ephemeral JWT is minted (15-minute TTL, non-renewable, restricted scopes). Master API keys are never delivered to the client.
3
Pillar 3: Neutral UI Lockout & 0-Byte Exfiltration Shield
When an unauthorized origin attempts to load the widget, the bootstrap handshake terminates with HTTP 403 Forbidden. The client script renders a neutral unavailable lock icon. Crucially, 0 bytes of RAG knowledge data, 0 system prompts, and 0 LLM tokens are delivered, preventing information leakage.
4
Pillar 4: Sub-5ms Global Kill-Switch & Immutable SOC2 Telemetry
In the event of key leakage or contractor offboarding, administrators can revoke a deployment with a single click. Invalidation propagates across all edge clusters in under 5ms. Every authorization, mismatch, and revoked attempt is recorded in the immutable Security Event Log with risk scores from 0.0 to 1.0.
3. Threat Mitigation & Architecture Matrix
| Threat Vector |
Traditional Widget Risk |
Let's Chat Defense Action |
Verified Outcome |
| Copied Snippet Hijacking |
Agent runs on competitor site; quotas stolen |
Edge gateway drops handshake on origin mismatch |
403 Forbidden; Neutral Lock Icon |
| RAG Vector Data Snooping |
Internal pricing & knowledge exfiltrated |
Knowledge embeddings isolated behind domain JWT |
0 Bytes Exfiltrated Guarantee |
| Compromised Deployment Key |
Requires redeploying website code to revoke |
One-click administrative suspension tombstone |
< 5ms Invalidation Across All Edge Nodes |
| DNS TXT Revocation |
15m stale window allows persistent chat on deleted domain |
O(1) pre-execution check on /api/chat + 15s client attestation heartbeat |
< 5ms Edge Revocation; Instant Session Severance |
| Host DOM Script Tampering |
Host JavaScript intercepts chat messages & tokens |
Closed Shadow DOM encapsulation & scoped worker |
Total Host DOM Isolation |
Compliance & Governance Certification
Singapore IMDA GenAI
Fully aligned with IMDA Model AI Governance Framework for safety, traceability, and accountability.
OWASP Top 10 for LLM
Zero-byte exfiltration eliminates LLM06 (Sensitive Information Disclosure) and LLM07 (Insecure Plugin Design).
SOC 2 Type II Telemetry
All credential issuance and origin mismatch events logged with immutable cryptographic timestamps.