I've added an explanation of Supple's sandbox: gitano.org.uk/supple/ I'd appreciate it if security-minded people looked and gave me feedback.