Your embedded signing iframe works. Whose URL did you put in it?

The iframe loads. The signature box works. Then someone picks sessions[0] and gives the wrong person a signing URL.

That's the embedded-signing bug I worry about before I worry about styling.

I build PutMySign. Its embedded send response gives your server one session per recipient. Your browser should get only the current person's URL, not the whole array and definitely not the API key.

My checks before shipping:

• Bind the signed-in user to a stored document and recipient in your own database. An email or recipient ID from the browser isn't permission.
• Treat allowed origins as framing permission, not a login check.
• Keep tokenized URLs out of logs, analytics and shared caches.
• Don't call the template-send endpoint again because an iframe expired. It creates a document, not a refreshed view of the old one.
• Finish the business workflow from a verified server event, not onSigned in the browser.

I wrote a small server-side Node.js helper and tested the wrong-user, wrong-document, wrong-recipient and unexpected-URL paths. It isn't a complete auth system or a production signing test, and the guide says so.

The full guide has the code and the traps: https://putmysign.com/guides/embedded-signing-security