Copy link to headingA sandbox has more than one boundary

Copy link to headingA network bypass can be a sandbox escape

Copy link to headingUseful sandboxes need selective connectivity

Copy link to headingHow Vercel enforces the network boundary

Copy link to headingKeep credentials outside untrusted compute

Copy link to headingPut your own policy in the path

Copy link to headingSecurity belongs in the baseline product

Copy link to headingGetting started

import { Sandbox } from '@vercel/sandbox';const sandbox = await Sandbox.create({ networkPolicy: { allow: { "ai-gateway.vercel.sh": [{ transform: [{ headers: { "Authorization":Bearer ${process.env.AI_GATEWAY_TOKEN}} }], }] } }});``await sandbox.update({ networkPolicy: 'deny-all' });