Optional ReadonlyallowAccept every https iframe source. Only for environments where authors are trusted: an arbitrary frame can phish, fingerprint or autoplay audio.
Optional ReadonlyallowExtra https hosts allowed as iframe sources, matched exactly or as any
subdomain (example.com also admits player.example.com).
Options shared by the schema, the URL detector and the commands: which third-party hosts an
<iframe>may point at. They are captured once, when the nodes are created, so the same allowlist vets pasted HTML,insertEmbedand the renderedsrcalike. There is no path into the document that skips the check.