Most of the sandboxing just comes from using embedded Lua and only whitelisting a small number of functions. We also do a little process-level isolation to prevent runaway processes.
Nice, It would be awesome if one could get full capability of a programming language. I have been planning to build something like this but was stuck because of the sandboxing issue.
