And those aren't good enough as he was able to bypass them with ls - command line tool ran without privilege inside of a sandboxed app. This is a serious issue

And those aren't good enough as he was able to bypass them with ls - command line tool ran without privilege inside of a sandboxed app. This is a serious issue for data leakage.