Reason/benefit of loading html file instead of data/blob/srcdoc/blank+document.write in iframe? about flems

[anonghuser]

After trying out some stuff I guess it is for proper sandboxing while still having a non-null origin and thus access to localStorage and similar.

But now that I understand that part, I think a warning in the documentation should be added for people that self-host the module to serve it from a separate origin (i.e. subdomain or port) or the sandbox can be escaped. While that is not critical for normal usage, i.e. when a user is just running their own sample code, it becomes an issue if the ability to run code from other users is added in their use-case. Those using it directly from flems.io are safe of course.

[porsager]

Would be good to document more - PR welcome ;)