Background
The plugin problem: what EmDash's sandbox protects and what it doesn't
EmDash promises safe plugins thanks to its sandbox. I ran a probe plugin locally and on Cloudflare: what the sandbox really blocks, where its limits kick in and why the plugins agencies build most often run outside it.