Security

#The iframe boundary

The popup is an iframe served from https://mosh.events. Card entry and payment happen there, never on your page. No card data, no payment-provider script and no PCI scope moves to your site.

#What embed.js does on your page

• Reads link hrefs and data-mosh-* attributes to find booking buttons.
• Adds one overlay element to <body> when a popup opens, and a <style> tag for its own classes.
• Locks body scroll while the popup is open and restores it on close.
• Listens for postMessage from the popup — only from its own origin — for close, ready and complete signals.

It doesn't read cookies, forms, local storage, or anything else on your page, and it sends nothing about your page to Mosh beyond the host origin (used as the postMessage target so the popup can talk back).

#Which sites can frame your booking flow

The Mosh booking frame allows embedding on any origin today. Per-venue allowed-origin lists will follow, set from your dashboard, so only your site can frame your booking flow.

#Content Security Policy

If your site sets a CSP, allow:

script-src  https://mosh.events
frame-src   https://mosh.events

#What guest data your site receives

Guests enter their name, email and phone inside the popup, on Mosh. That data belongs to the venue's Mosh account and is governed by Mosh's privacy policy. Your website doesn't receive it; the only thing your page is told is that a booking completed and its id (see mosh:complete).

#Reporting a vulnerability

Email hello@mosh.events with "Security" in the subject.