istanbul: fix sandbox violations