# Run unfamiliar research repositories without lending them your laptop’s credentials

Source: https://www.web3sec.news/blog/untrusted-repository-research-sandbox
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Record revision and inspect install, build, test and editor automation.
- [ ] Use a disposable boundary without home directories or forwarded credentials.
- [ ] Set process resources, timeout and enforced outbound restrictions.
- [ ] Review injected tokens and forwarded ports in hosted environments.
- [ ] Test denial using dummy secrets, then review exports and revoke access.

## References
- [Docker: rootless mode](https://docs.docker.com/engine/security/rootless/)
- [Docker: seccomp profiles](https://docs.docker.com/engine/security/seccomp/)
- [Docker: resource constraints](https://docs.docker.com/engine/containers/resource_constraints/)
- [GitHub: security in Codespaces](https://docs.github.com/en/codespaces/reference/security-in-github-codespaces)