Scoped Threat Model & Executive Summary
Modern enterprise AI website chatbots face security risks when deployed via client-side JavaScript tags. Traditional implementations expose static API tokens, allow unauthorized host domains to hijack agent quotas, and fail to prevent unauthorized parties from attempting knowledge base vector exfiltration.
Let's Chat enforces a multi-tier Zero-Trust Platform Defense Architecture: cryptographic DNS ownership verification, strict HTTP Origin header attestation, short-lived ephemeral JWT session credentials, and measured sub-5ms edge lookup revocation. Under automated regression test suites, requests from unverified browser origins receive an immediate HTTP 403 Forbidden with 0 bytes of RAG knowledge vectors, system prompts, or LLM tokens transmitted.
1. Threat Landscape for Embeddable Autonomous Agents
Autonomous web agents possess direct integrations into enterprise CRMs, product databases, and meeting schedulers. Exposing these capabilities to the open internet introduces three primary attack vectors:
Copied Snippet Hijacking
Competitors or phishing sites copy the <script> embed tag to their own domain, stealing agent reasoning and draining LLM API tokens.
OWASP LLM06 Exfiltration
Malicious origins query the chatbot with prompt injections to systematically extract internal RAG knowledge vectors and confidential pricing formulas.
Stolen Deployment Key
Leaked deployment IDs used in rogue scrapers or automated bot swarms without real-time revocation mechanisms.
Threat Model Scope & Limits: HTTP Origin and Referer validations are browser-enforced security mechanisms designed to mitigate cross-origin snippet copying on public websites. Because non-browser API clients or automated tools can synthesize arbitrary headers, Let's Chat pairs origin checks with server-side rate limits, ephemeral signed JWTs, and tenant-partitioned vector isolation rather than relying on client headers as a singular authentication mechanism.
2. Four Pillars of Let's Chat Zero-Trust Defense
1
Pillar 1: Two-Tier Cryptographic Domain Anchoring (DNS TXT Verification)
Before an agent can be configured, domain ownership is attested using automated Namecheap DNS API or manual TXT challenge records (letschat-site-verification=<token>). Ongoing operational revocation is enforced via edge administrative tombstones and periodic re-attestation polling, independent of DNS propagation TTL delay.
2
Pillar 2: Edge Handshake & Ephemeral Scoped JWT Minting
The client loader initiates an attestation handshake via POST /api/bootstrap. The Let's Chat edge gateway strictly validates HTTP Origin and Referer headers against the whitelisted domain. If valid, an ephemeral JWT is minted (15-minute TTL, non-renewable, restricted scopes). Master API keys are never delivered to the client.
3
Pillar 3: Neutral UI Lockout & Verified Zero-Payload Transmission
When an unauthorized origin attempts to load the widget, the bootstrap handshake terminates with HTTP 403 Forbidden. The client script renders a neutral unavailable lock icon. Under automated regression test suites, zero RAG knowledge vectors, zero system prompts, and zero LLM completions are delivered to unverified origins.
4
Pillar 4: Measured Sub-5ms Edge Revocation & Immutable SOC2 Telemetry
In the event of key leakage or contractor offboarding, administrators can revoke a deployment with a single click. Invalidation lookups execute in < 1ms locally and propagate across regional edge clusters in < 5ms, with downstream edge caches bounded by TTL. Every authorization, mismatch, and revoked attempt is recorded in the immutable Security Event Log with risk scores from 0.0 to 1.0.
3. Threat Mitigation & Architecture Matrix
| Threat Vector |
Traditional Widget Risk |
Let's Chat Defense Action |
Verified Outcome |
| Copied Snippet Hijacking |
Agent runs on competitor site; quotas stolen |
Edge gateway drops handshake on origin mismatch |
403 Forbidden; Neutral Lock Icon |
| RAG Vector Data Snooping |
Internal pricing & knowledge exfiltrated |
Vector embeddings isolated behind domain JWT; edge drops request prior to vector search |
Tested 0-Payload Transmission |
| Compromised Deployment Key |
Requires redeploying website code to revoke |
One-click administrative suspension tombstone in portal |
Measured < 1ms local lookup; < 5ms regional sync |
| DNS TXT Revocation |
DNS TTL propagation delay allows window of query activity |
Two-tier lifecycle: DNS TXT proof + edge administrative tombstone on /api/chat + 15s client heartbeat |
Immediate Session Severance Independent of DNS TTL |
| Host DOM Script Tampering |
Host JavaScript attempts to inspect widget styling or state |
Closed Shadow DOM encapsulation isolates styles/DOM. Per MDN guidance, shadow roots are not a security barrier against hostile in-page code; tokens and vector access remain strictly server-side |
Client Style/DOM Encapsulation (Server-Secured Secrets) |
Compliance & Governance Architecture
Singapore IMDA GenAI Framework
Designed with reference to Singapore's Model AI Governance Framework for Agentic AI (v1.5, released 22 January 2026) and AI Verify Foundation testing guidelines. Self-attested architectural mapping.
OWASP Top 10 for LLM
Domain-scoped knowledge isolation mitigates LLM06 (Sensitive Information Disclosure) and LLM07 (Insecure Plugin Design).
SOC 2 Type II Telemetry
All credential issuance and origin mismatch events logged with immutable cryptographic timestamps.