Sandbox Security

Sandbox blocks unsafe command and path patterns, defaults network policy to deny-all for untrusted execution, redacts secrets, hashes safe request metadata, and never exposes raw x-vercel-ja4-digest publicly.