Sandvault author here: thanks for the shout-out! I would add that in addition to Unix permissions, sandvault also utilizes macOS sandbox-exec to further limit

Sandvault author here: thanks for the shout-out! I would add that in addition to Unix permissions, sandvault also utilizes macOS sandbox-exec to further limit the blast radius.