Afterburner – Capability-Sandboxed JavaScript/TS Runtime in Rust
Wraps node, npm, and bun under sandbox without code changes, but Deno already does capability security.

145k LOC browser engine in C with no JIT and spec-first compliance.
Systems programmers, privacy-focused users, browser engine enthusiasts
Ladybird Browser · SerenityOS Browser
https://github.com/nordstjernen-web/nordstjernen/releases/ta...
Wraps node, npm, and bun under sandbox without code changes, but Deno already does capability security.
Hand-written engine beats Bun on cold start with a 9 MB binary.
Domain-allowlist network sandbox for any process—no VM, native Landlock and overlayfs.
O-cap security model beats the credential-bag approach every agent framework currently uses.
Cap-std sandboxing with no-bash design is a coherent security story for agents.
Cloudflare Workers API without Cloudflare, compiled to a single WASM binary.