client/lib/post-normalizer/rule-content-make-embeds-safe.js
function doesNotNeedSandbox( iframe ) {
	const trustedHosts = [
		'spotify.com',
		'kickstarter.com',
		'soundcloud.com',
		'embed.ted.com',
		'player.twitch.tv',
	];

	const hostName = iframe.src && url.parse( iframe.src ).hostname;
	const iframeHost = hostName && hostName.toLowerCase();

	return some( trustedHosts, trustedHost => endsWith( '.' + iframeHost, '.' + trustedHost ) );
}
function doesNotNeedSandbox( iframe ) {
	const trustedHosts = [
		'spotify.com',
		'kickstarter.com',
		'soundcloud.com',
		'embed.ted.com',
		'player.twitch.tv',
	];

	const hostName = iframe.src && url.parse( iframe.src ).hostname;
	const iframeHost = hostName && hostName.toLowerCase();

	return some( trustedHosts, trustedHost => endsWith( '.' + iframeHost, '.' + trustedHost ) );
}
Internal Dependencies
 Given an iframe, is it okay to have it run without a sandbox?
@param {object} iframe - the iframe to check
@returns {boolean} true/false if we trust the source and we know they don't work in a sandbox