CC is really good at finding ways to work around denied permissions. The only safe solution is some kind of vm.