Most of them are open source, I maintain the spreadsheet called EasyCalc or running in it. Sandstorm treats each and every of those application as hostile and malicious. It very strongly sandboxes each particular application running in it, changing the domain every time a new instance is made to prevent cross site script attacking.