Hello world, this is the client's website.

It runs on its own domain and tech stack. The only thing added for the chatbot is the single <script> tag at the bottom of this page.

Click the green button in the corner to open the chat. The chat UI is loaded from the chatbot's domain inside an iframe, so this page never sees the conversation and the chatbot can ship updates without us changing anything.

Try it: open DevTools → Network and watch /api/config (cross-origin, CORS) and /embed (iframe, served with frame-ancestors for this origin only). Then open this page from a different origin, e.g. http://127.0.0.1:3000, and the widget refuses to load.