There's no sandboxing on the server since all the challenges this year were essentially exploiting the trust relationship between the client and the server (or required reverse engineering that was just hard regardless of where the logic was). We certainly didn't /intend/ for someone to directly exploit the server, though it's always a possibility in these sorts of games. If so, they deserved the points they got (not all the flags were available even if you did hack it as some challenges were outside of the game).

It was also somewhat mitigated by the fact that the game was deployed on AWS instances just for that weekend and it was easy to bring up new instances any time we needed it, so someone cracking the server could certainly cause trouble, but there really wasn't any long-term damage they could do.