Pretty nifty project. I'm curious what whitelist are you using, would it be possible to list allowed domains somewhere publicly.
One suggestion that I have is to remove w3schools.com from the whitelist. MDN is a much better source for information about web development.