The front-end widget script is now loaded via wp_enqueue_script() instead of a hardcoded tag; the data-tenant / data-mode attributes are added through the script_loader_tag filter and escaped with esc_attr.
0.1.1
Hardening: the front-end widget tag is now rebuilt from its parsed parts and escaped per context (esc_url / esc_attr) before output, instead of echoing the stored snippet string directly.