Statement
A generic Embed component shall apply restrictive iframe defaults (sandbox with allow-scripts and allow-same-origin only, no allow attributes by default, no allowfullscreen by default, referrerpolicy of strict-origin-when-cross-origin or stricter) with explicit opt-in escape hatches for permissions.
Rationale
Generic iframe embedding requires a secure-by-default posture. Delivered by PLN-1 (D-PLN1-03).
Topics
Owner: component-system
Related: analytics-privacy
Applies To
- Interactive Components DOC-00043