Sandbox Check

What can untrusted HTML reach from your preview iframe?

Chat apps render model-written HTML in sandboxed iframes, and a single attribute decides whether that page is a stranger or your own site. Set up the iframe the way your app does. A probe page inside it tries, harmlessly, to read your cookies, call your API, send data out and move your tab.

Render it like your app does

How the HTML gets in

Sandbox Add a sandbox attribute

Content Security Policy inside the frame

None No network Custom

Permissions Policy (allow)

Your iframe

Probing…

The untrusted page

Test your own app

Copy the probe as a standalone HTML page and get it rendered in your preview feature: paste it into your app, or ask your model to output it verbatim. It reports from inside the frame what it can reach. Nothing in it changes the host page; the only requests it makes are for a tiny image on this site, to test whether data can get out.

The short checklist

Never combine allow-scripts with allow-same-origin on srcdoc or blob URLs.
Best of all, serve previews from a separate origin that has no cookies, storage or APIs worth stealing.
The sandbox doesn't stop requests going out. A CSP inside the frame does.
srcdoc and blob frames inherit your page's CSP, so test with your real headers.
Every message listener checks event.source. event.origin is "null" for every sandboxed frame.
Leave out allow-popups-to-escape-sandbox, allow-top-navigation and an allow list you don't need.