Security

• The host validates event.origin against allowedPostMessageOrigins/kycFrontOrigin.
• The iframe is created with allow="camera; geolocation; microphone; clipboard-write; fullscreen" and referrerpolicy="origin".