If you discover a security vulnerability within safe-py-runner, please report it via GitHub Issues (or email if desired).

safe-py-runner is a guardrail layer, NOT a robust OS-level sandbox.

It is designed to run semi-trusted code (e.g., generated by your own LLM agents) with safety nets against accidents (infinite loops, excessive memory usage) and basic restrictions (blocking os.system).

Do NOT use this library to execute arbitrary code from anonymous public users without additional layers of isolation such as:

• Docker containers
• Virtual Machines (Firecracker, gVisor)
• nsjail or comparable OS-level sandboxing tools.

This library relies on Python runtime hooks and subprocess isolation. A determined attacker with sufficient knowledge of Python internals may be able to bypass these restrictions.

Resource limit caveat: memory enforcement uses platform RLIMIT behavior. On macOS, RLIMIT_AS may be ineffective compared with Linux.