Thanks! We do have some instructions on how to integrate once you've generated your embed code on sign up however I agree this should also be available without sign up. Privacy/security have been questions we get from almost everyone so we're actively working on better documentation around this. I'll make sure to include info about XSS.