I don't think you need to use a safe subset as much as you need to run everything in a sandbox of some sort.