zlacker

>>dmpetr+(OP)
I'm enjoying watching the battle for where to draw the sandbox boundaries (and I don't have any answers, either!)

>>Retr0i+Vu
best answer is probably to have a layered approach - use this to limit what the generated code can do, wrap it in a secure VM to prevent leaking out to other tenants.