Script sandbox

Scripts run in a sandbox: QuickJS, a separate JavaScript engine compiled to WebAssembly. Each request (with its collection and folder scripts and auth dependencies) or collection run gets its own engine, limited to 256 MB, and every script in it gets a fresh context with its own globals, limited to 30 seconds and a fixed stack depth. They can't reach Node, files, other processes or HttpDash's own data. They can still send requests with pm.sendRequest and read the variables in scope, so review scripts from people you don't trust before running them. See SECURITY.md.