I sandbox everything inside https://github.com/strongdm/leash

That way the blast radius is vastly reduced.