Write it. Run it. Break it. Fix it.

This first sandbox executes client-side HTML, CSS and JavaScript inside a sandboxed iframe with a restrictive content-security policy. Server execution is intentionally not exposed.