Gitea needs allow-same-origin to keep a session and allow-scripts for the
interface to work, and those two together give back everything sandbox takes
away. The browser says so on every load: "an iframe which has both
allow-scripts and allow-same-origin can escape its sandboxing."
So it was decoration that emitted a warning nobody can act on, which is how
people learn to ignore warnings. What actually stands here is that this is
Gitea's own interface, on the platform's own origin, through a proxy the
platform wrote.
officer
9d219e9c8c