Preliminary research
Sandcastles, Not Sandboxes: auditing Pyodide-to-host trust boundaries
AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Traces restricted Python execution through ctypes and Emscripten exports into the runtime embedding Pyodide. Product cases separate interpreter restrictions from host capabilities, data and credentials, providing a method for assessing the actual deployment boundary rather than treating WebAssembly alone as an application sandbox.
Record
- Researcher
- Vladimir Tokarev and Saar Pearl
- Published by
- Cyera Research
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Vladimir Tokarev and Saar Pearl, first published at the original source. Preserved copies are kept so the citation survives its host.