Ask HN: Deploy a sandboxed desktop software?

I have a nw.js application but at the same time I don't want to allow malicious code to be run on the clients machines. My thought was to put the app in a sandbox and distribute the software along with the sandbox. Has anybody run into such situation with Electron/nw.js? Say you ship a browser built on Electron/nw.js, how do you make it secure enough and is sandboxing the right approach? I'm not sure where to ask this question as stackoverflow has already closed it