The real security comes from carefully controlling the possible side effects on the host side as completely as possible. The process on the server that is running this should have access to
only the files or services required to complete the task, and nothing else.
Containerize, run in a virtual environment, etc... assume Satan himself gets to tweak your source code... does the environment that it runs within guarantee you won't have a disaster on your hands?
Applications can't deliver security, it's the Operating System's job to do that.
