Set the target origin

index.html

@@ -25,7 +25,7 @@
 				window.parent.postMessage({
 					queryString,
 					hash,
-				}, "*");
+				}, "https://huggingface.co");
 			}
 		</script>
 	</body>