I think nobody really use JS for untrusted code