This blog post describes an experiment demonstrating how to load an app in a CSP-protected sandboxed iframe. It introduces a custom fetch() to intercede on CSP errors, offering users the ability to add domains to an allow-list and refresh the page accordingly.