Hey azdle, thanks for the question and being honest. Do you mind me asking who you work for? Just curious more than anything.

To answer your questions about the alert code, yes it runs in a sandbox, but we also parse it and take it through a pretty lengthy pre-check process to weed out any code that might cause performance bottlenecks or general security problems.

As for websockets, we actually do support them (well, technically socket.io) but just don't make it very clear in the documentation. If you take a look at our open-source javascript client (https://github.com/buglabs/dweetio-client/blob/master/dweet....) you can see that we're actually using it there.

Hope that helps.