We don't allow any external calls/loads and strictly limit access to just DOM operations in the iframe. Not many people use JS in ads with our platform, so we spend the time to thoroughly vet them.