Why a sandboxed preview matters
HTML from emails, tickets or AI assistants can contain scripts and trackers. Here it renders inside an iframe without same-origin rights: it cannot read this page, your saved projects or cookies, cannot open popups and cannot navigate the main window. A strict Content Security Policy blocks all network requests until you switch Network on.
The test suite includes hostile pages that try window.parent access and outbound fetches, and checks they are blocked.
Responsive checks
Use the size menu to render at phone (375 px), tablet (768 px) or desktop (1280 px) widths. Console messages and errors from the page appear in the Console tab with links back to the source line.
Questions
Can the preview see my other projects?
No. The preview runs in a separate opaque origin with no access to this site’s storage.
Why are images from other sites missing?
External requests are blocked by default. Turn on Network in the preview bar to load them.
Can I take a screenshot of the preview?
Not from inside the app: browsers do not let a page capture a sandboxed cross-origin frame without screen-capture permission. Use your operating system’s screenshot tool.