Adereso vs LochBot

What is Adereso?

Adereso is an AI Marketing tool that serves as a conversational commerce system, automating sales and post-sales processes across multiple channels using artificial intelligence.

Who is Adereso for?

Adereso is designed for businesses looking to automate customer support and sales processes, particularly those utilizing WhatsApp for mass sales and communication.

What can I do with Adereso?

With Adereso, you can centralize communication across various channels, automate up to 98% of customer responses, and launch segmented WhatsApp campaigns with personalized messages.

How much does Adereso cost?

Adereso publishes a custom / contact-sales pricing model — get a quote on their site.

How is Adereso different from alternatives?

Adereso differentiates itself by focusing on conversational commerce and providing a comprehensive platform that centralizes support and sales interactions across multiple channels.

What is a Content Security Policy?

A Content Security Policy (CSP) is an HTTP response header that tells the browser which sources of content are allowed to load on a page. CSP prevents Cross-Site Scripting, clickjacking, and other code injection attacks by restricting where scripts, styles, images, fonts, and other resources can be loaded from. When a resource violates the policy, the browser blocks it and optionally reports the violation.

What is the difference between CSP Level 2 and Level 3?

CSP Level 2 introduced nonce-based and hash-based script allowlisting, the base-uri directive, and the form-action directive. CSP Level 3 added the 'strict-dynamic' keyword, the 'report-sample' keyword, and the worker-src directive. Level 3 also introduced navigate-to for controlling navigation targets. Most modern browsers support Level 3.

Should I use 'unsafe-inline' in my CSP?

Avoid 'unsafe-inline' for script-src because it defeats CSP's primary XSS protection. If inline scripts are allowed, any injected script will also execute. Instead, use nonce-based CSP or hash-based CSP. For style-src, 'unsafe-inline' is more acceptable because inline styles are a lower-risk vector, though nonce-based styles are still preferred.

How do I deploy CSP without breaking my site?

Start with Content-Security-Policy-Report-Only instead of Content-Security-Policy. This header logs violations without blocking resources, letting you identify what would break. Monitor the violation reports, adjust your policy to allow legitimate resources, and repeat until violations are only from actual threats. Then switch to the enforcing header.

What is strict-dynamic and when should I use it?

'strict-dynamic' tells the browser to trust scripts loaded by already-trusted scripts. When combined with a nonce, you only need to add the nonce to your top-level scripts — any scripts they dynamically load are automatically trusted. This simplifies CSP for applications using script loaders, tag managers, or dynamically created script elements.