<p><span class="h-card" translate="no"><a href="https://fosstodon.org/@phated" class="u-url mention">@<span>phated</span></a></span> that&#39;s what the sandbox escape is from. even if you restrict globalThis in the context</p>