alright, let's blame developers! :)

and regards flaws - sandbox could be more tightly coupled with Content security policy. Not a big deal, but posts look really misleading telling "put it in sandbox, well done"