diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..defc80c
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2025-01-30 - Prevent XSS in Email Previews with Sandboxed Iframes
+**Vulnerability:** Use of `dangerouslySetInnerHTML` for rendering email HTML, even when sanitized by `DOMPurify`, can present residual XSS risks.
+**Learning:** Using a sandboxed `iframe` with `srcDoc` and `sandbox="allow-popups allow-popups-to-escape-sandbox"` eliminates script execution and same-origin access risks, providing defense in depth. However, styles must be manually injected via `<style>` tag within the `srcDoc` to preserve visual formatting because Tailwind classes on the `iframe` do not affect inner elements.
+**Prevention:** Default to using sandboxed `iframes` for displaying any complex, untrusted, or dynamic HTML rather than relying solely on sanitization libraries.
diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..7f2963a 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -232,8 +232,22 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
                 )}
               </div>
             </div>
-            <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+            <div className="min-h-[24rem] w-full overflow-hidden bg-white text-sm text-black">
+              <iframe
+                title="Email Preview"
+                srcDoc={`<style>
+                  body {
+                    margin: 0;
+                    padding: 1.5rem;
+                    font-family: ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+                    font-size: 0.875rem;
+                    line-height: 1.25rem;
+                    color: black;
+                  }
+                </style>${sanitizedEmailHtml}`}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="h-full min-h-[24rem] w-full border-0"
+              />
             </div>
           </div>
         </div>