You are specifically allowing the iframe to communicate with the parent window by specifying allow-same-origin in the sandbox attribute. Isolating code is a sol

You are specifically allowing the iframe to communicate with the parent window by specifying allow-same-origin in the sandbox attribute. Isolating code is a solved problem if you use a separate domain and allow the browser's cross domain policies to do their job. Calling this Sandbox.js is pretty irresponsible. The term is well defined and well understood. You can't just use the name because it sounds nice.