While not implemented, Bun may eventually have an alternative to Deno's sandboxing: https://github.com/oven-sh/bun/discussions/725

"Rather than runtime permission checks (Deno's model) which could potentially have bugs that lead to permissions being ignored, Bun plans to have binary dead code elimination based on statically analyzing what features/native modules are used by the code."