Content Security Policy

If your site sends a Content Security Policy, it must allow the script and the frame. Without both, the widget fails with PV-E105.

Content-Security-Policy:
  script-src 'self' https://peoplevouch.com;
  frame-src 'self' https://peoplevouch.com;

The widget itself sets frame-ancestors *, so any site may frame it. It carries no cookies, reads no storage on your page, and sends only its own height to the parent window.

What the widget sends you

One message, and only about size: { source: "peoplevouch", nonce, type: "resize", height }. The loader checks the origin and the nonce before it acts on a message, and clamps the height, so a page with several widgets cannot be confused by another frame.