## Description
Relatively minor, but explicitly omitting `allow-same-origin` from the help widget iframe `sandbox` attribute in packages/help-extension breaks search pages on many reference documen…
When you subscribe for push you receive a endpoint and keys for generating push and payloads.
You can forge a payload fully in the browser but not all endpoints don't respond with CORS headers.
(Go…