Variable: DEFAULT_SECURITY_CONFIG

const DEFAULT_SECURITY_CONFIG: SecurityConfig;

4.0.1 default security configuration.

• allowedOrigins: empty — caller MUST supply their iframe origin(s).
• strictMode: true — loud-fail default (current).
• additionalOrigins: omitted — consumers opt-in.

Frozen to prevent accidental mutation by consumers that spread it into their own config object ({ ...DEFAULT_SECURITY_CONFIG, ... }).