People expect to check source code before running it. They do not expect to have to check it before compiling it. Why are they compiling untrusted code? To se

People expect to check source code before running it. They do not expect to have to check it before compiling it. Why are they compiling untrusted code? To see if it's syntactically correct? If the code you're compiling is using a build system, you're already compromised. Compilation of untrusted code should always be sandboxed, regardless of compile-time programming capabilities.