How Notion Workers run untrusted code at scale with Vercel Sandbox

This article explains how Notion Workers uses Vercel Sandbox to safely execute untrusted code at scale with strong security isolation.

• •Each Worker runs in an ephemeral Firecracker microVM with its own kernel, filesystem, and network stack, providing stronger isolation than containers
• •Credential injection is handled at the network level via Sandbox's firewall proxy, so API keys never enter the execution environment, eliminating prompt injection risks
• •Dynamic network policies can be updated at runtime without restarting processes, enabling fine-grained egress control for enterprise customers
• •Filesystem snapshots allow dependencies to be installed once and reused on subsequent invocations, combined with active-CPU billing to keep costs predictable
• •