It's just assumed you'll run it in an isolated container, or some other sandbox...