Thanks!!
Excellent question. We're using a node sandboxing environment that nobody has been able to break out of yet, but we plan to move to a more secure isolation model very soon.
We're still small enough that we can keep decent tabs on what folks are doing with the platform, but it's only a matter of time before the DDOSers and crypto miners come looking for trouble...