Author here. One thing to emphasize is that all processes run in the browser and are isolated from whatever underlying OS/filesystem the browser is running on - there is nothing special to think about in terms of sandboxing or security. If as a developer you want to give users access to their underlying filesystem, you can do so as usual (HTML5 FS API in Chrome,
https://developer.mozilla.org/en-US/docs/Using_files_from_we... in general).