A widget is a small self-contained HTML/JS component that runs in a locked-down sandbox — no network, no cookies, no access to the page. It talks to the doc only through margin.state / margin.setState(). Inline all your JS and CSS: external scripts and stylesheets won't load. A reviewer reads the code before it goes public.