Translations:Security Notes on Remote Embedding/21/en

Also you will want to proxy your transcript queries so they are local scrubbed queries instead of javascript injections.