diff --git a/web/GiteaFrame.tsx b/web/GiteaFrame.tsx
index 546f6d5..677fdb0 100644
--- a/web/GiteaFrame.tsx
+++ b/web/GiteaFrame.tsx
@@ -105,9 +105,16 @@ export const GiteaFrame = () => {
         src={FRAME_SRC}
         title="Gitea"
         className="h-full w-full border-0"
-        // Same origin, so `allow-same-origin` is what lets Gitea keep its session at all. Scripts and
-        // forms are Gitea's own — this is its interface, not untrusted content.
-        sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-downloads"
+        // NO `sandbox`, deliberately.
+        //
+        // It needs `allow-same-origin` for Gitea to keep a session and `allow-scripts` for the interface
+        // to work at all — and those two together give back everything the attribute takes away. The
+        // browser says so itself: "an iframe which has both allow-scripts and allow-same-origin can
+        // escape its sandboxing."
+        //
+        // So it was decoration that emitted a warning on every load, and a warning nobody can act on
+        // teaches people to ignore warnings. What actually stands here is that this is Gitea's own
+        // interface on the platform's own origin, reached through a proxy the platform wrote.
       />
     </div>
   );