Iframe sandbox policy builder

Sandbox tokens are a blunt instrument: allow-scripts plus allow-same-origin on your own origin hands the frame full access to everything, because its script can strip the attribute and reload unsandboxed. On another origin the same pair only gives the frame back its own cookies and storage, which is a trade you may accept knowingly. This tool writes the attribute and grades the combination. It does not render a live frame, and it cannot see the CSP header the framed page ships.