Secure by defaultExact origin allowlist, sandboxed iframe and no personal data in URLs or host messages.