Prevent clickjacking using Office.js
问题 The documentation at https://github.com/OfficeDev/office-js-docs/blob/master/docs/develop/privacy-and-security.md#tips-to-prevent-clickjacking lists a bunch of ways to help prevent clickjacking, by having the user confirm before performing potentially dangerous actions. I was wondering if it would be just as safe to not render any UI on the page at all, until Office.initialize is called? Or is there a way for an attacker to iframe my add-in on their page and somehow replace the Office SDK