[Verse 1]
Building widgets for the world to see
JavaScript living wild and free
But when you're guest on someone's page
You need a safe and sandboxed stage
Shadow DOM will hide your style
Keep your code secure meanwhile
Iframe boundaries standing tall
Protecting both from any fall
[Chorus]
Widget builder, cross-domain fighter
Bundle small and make it lighter
Version safe and backwards true
Security in all you do
Sandbox, shadow, message pass
Cross-origin built to last
Widget builder, system thinker
Distributed code that's never a sinker
[Verse 2]
PostMessage API calls across the divide
CORS headers keep the data flow right
Token handling in untrusted space
XSS prevention sets the pace
CSP headers lock it down
Trust boundaries all around
Communication bridge secure
Data passing clean and pure
[Chorus]
Widget builder, cross-domain fighter
Bundle small and make it lighter
Version safe and backwards true
Security in all you do
Sandbox, shadow, message pass
Cross-origin built to last
Widget builder, system thinker
Distributed code that's never a sinker
[Bridge]
Every kilobyte counts when you're not at home
Legacy versions can't be left alone
Microservice thinking in the browser space
Isolation patterns keeping things in place
Partners embed but can't update
Backwards compatibility can't be late
[Verse 3]
Build once and deploy everywhere
Third-party trust beyond compare
Full-stack thinking in frontend land
Distributed systems you understand
Safe execution in hostile ground
Conflict-free styles that won't break down
Dashboard widgets, tools that shine
Living in someone else's design
[Chorus]
Widget builder, cross-domain fighter
Bundle small and make it lighter
Version safe and backwards true
Security in all you do
Sandbox, shadow, message pass
Cross-origin built to last
Widget builder, system thinker
Distributed code that's never a sinker
[Outro]
From sandbox to the final ship
Third-party widgets, partnership
System thinking all the way
Embedded code that's here to stay