diff --git a/public/jsgist-runner.js b/public/jsgist-runner.js
index 2236fc1..59d65a7 100644
--- a/public/jsgist-runner.js
+++ b/public/jsgist-runner.js
@@ -4,6 +4,23 @@
   const params = Object.fromEntries(new URLSearchParams(window.location.search).entries());
   const url = new URL(params.url);
 
+  const allow = [
+    'accelerometer',
+    'bluetooth',
+    'camera',
+    'encrypted-media',
+    'display-capture',
+    'geolocation',
+    'gyroscope',
+    'microphone',
+    'midi',
+    'clipboard-read',
+    'clipboard-write',
+    'web-share',
+    'serial',
+    'xr-spatial-tracking',
+  ].map(v => `${v} *`).join('; ');
+
   let iframe;
 
   async function startServiceWorker() {
@@ -144,6 +161,7 @@ iframe {
   function insertInBlob(mainHTML, mainJS, mainCSS) {
     applyCSSToSelfToRunContentInIFrame();
     const iframe = document.createElement('iframe');
+    iframe.allow = allow;
     const html = makePageHTML(mainHTML, mainJS, mainCSS);
     registerSections(html);
     const blob = new Blob([html], {type: 'text/html'});
@@ -155,6 +173,7 @@ iframe {
   function insertInServiceWorker(mainHTML, mainJS, mainCSS) {
     applyCSSToSelfToRunContentInIFrame();
     const iframe = document.createElement('iframe');
+    iframe.allow = "accelerometer *; bluetooth *; camera *; encrypted-media *; display-capture *; geolocation *; gyroscope *; microphone *; midi *; clipboard-read *; clipboard-write *; web-share *; serial *; xr-spatial-tracking *"
     const html = makePageHTML(mainHTML, mainJS, mainCSS);
     registerSections(html);
     cacheFile('/user-jsgist.html', 'text/html', html);
diff --git a/src/components/Runner.js b/src/components/Runner.js
index 242a0c7..ede7f99 100644
--- a/src/components/Runner.js
+++ b/src/components/Runner.js
@@ -5,6 +5,23 @@ import ServiceContext from '../ServiceContext.js';
 import {createURL} from '../libs/url.js';
 import * as winMsgMgr from '../libs/WindowMessageManager';
 
+const allow = [
+  'accelerometer',
+  'bluetooth',
+  'camera',
+  'encrypted-media',
+  'display-capture',
+  'geolocation',
+  'gyroscope',
+  'microphone',
+  'midi',
+  'clipboard-read',
+  'clipboard-write',
+  'web-share',
+  'serial',
+  'xr-spatial-tracking',
+].map(v => `${v} *`).join('; ');
+
 export default class Runner extends React.Component {
   constructor(props) {
     super(props);
@@ -45,6 +62,7 @@ export default class Runner extends React.Component {
         this.data = data;
         this.removeIFrame();
         const iframe = document.createElement('iframe');
+        iframe.allow = allow;        
         this.iframe = iframe;
         iframe.src = isDevelopment
             ? createURL(`http://${window.location.hostname}:8081/runner-03.html`, {url: `http://${window.location.hostname}:8080/jsgist-runner.js`, ...extra})