How does the sandbox prevent malicious code from compromising my browser?
The previewer renders inside an `<iframe>` equipped with HTML5 `sandbox` attributes. This isolates the framed page into a unique null origin, preventing scripts from reading your cookies, accessing parent window properties, or triggering forced redirects.