Sandboxing
Sandboxing runs code in an environment with restricted access to other systems and resources, helping limit its effects and, in analysis settings, observe its behavior.
Isolation depends on what is connected
A sandbox can separate an unfamiliar program from the normal working environment. The useful question is what the program can still reach: network services, shared folders, credentials, devices, or other integrations.
Microsoft’s Windows Sandbox documentation provides one concrete example. Networking, clipboard access, and mapped folders have configurable behavior. Mapping a host folder with write access exposes those files to changes from inside the sandbox. Review those settings before running the sample.
A browser sandbox, an analysis service, and a disposable virtual environment are not interchangeable. Check which resources and operations the particular design restricts.
A quiet run does not certify the code
A program that shows no harmful behavior during one observation has only been observed under those conditions. It may behave differently with another input, permission, connection, or amount of time. Keep the environment and observation limits with the result.
The recruiting-code assessment article explains why the execution environment belongs in the decision before running a supplied project. Isolation is not a reason to put real credentials or sensitive files within the project’s reach.
For documents, the Office macro guide explains the difference between opening a file and allowing its code to run.