I think we need somehow distinguish this "sandbox" -with-security from the EAP -with-security. Otherwise we can have a mess on the local repository or get more confusion from the users. I thought the .sandbox on groupId could help.