[Retr0id]

I'm enjoying watching the battle for where to draw the sandbox boundaries (and I don't have any answers, either!)

[ushakov]

best answer is probably to have a layered approach - use this to limit what the generated code can do, wrap it in a secure VM to prevent leaking out to other tenants.