Sharing a deck from a link is a nice idea. How are you sandboxing it, an iframe with the sandbox attribute and no allow-same-origin, or a separate origin? I'd also check that decks can't make outbound network requests.