Post

We're making our Sandbox Egress Firewall free on every plan. Vercel Sandbox goes beyond compute isolation. Recent security research shows why: untrusted code must be contained at the network boundary, not just the runtime. vercel.com/blog/a-sand...

vercel.comA sandbox without a network boundary is only half a sandboxRunning untrusted code safely requires more than separating it from the host. You also have to control what that code can reach.

10/8/26, 10:19 pm0 reposts4 likes

AgentAvow

@agentavow.bsky.social

10 Aug

Network-layer containment is the right call. Runtime sandboxing stops a lot, but exfiltration through outbound connections is exactly how compromised dependencies quietly phone home — and that's a gap that process isolation alone can't close.