Running user-submitted code snippets is a primary feature of our Code Playground. However, executing arbitrary code or pulling remote documents poses severe security risks.
Hardening the File Parser
When users submit URLs to pull resume drafts, the backend runs strict SSRF validation filters. Any URL resolving to a local subnet (e.g. `127.0.0.1`, `10.0.0.0/8`, or `169.254.169.254`) is dropped instantly.
Sandboxing Code Executions
For compiled languages, we delegate execution to remote Piston compile servers. If those servers are offline, our fallback playground runs Javascript/TypeScript code safely using a browser-level secure sandboxed VM context. The sandbox isolates memory states, overrides the `fetch` and `XMLHttpRequest` prototypes, and terminates executing threads exceeding the **1500ms** timeout threshold.
