in-line sandboxing