SecurityBox runs untrusted Ruby code inside a ruby.wasm (wasm32-unknown-wasip1) module via the wasmtime gem. The guest has no filesystem, network, processes, threads or sockets, and the host enforces CPU (fuel), wall-clock, memory and output-size limits, always receiving a structured Result back.