How Notion Workers Runs Untrusted Code at Scale Using Vercel Sandbox

Notion Workers provides a feature that lets users run custom code to sync external data or trigger automations. However, executing arbitrary code generated by third-party developers or agents can create serious security issues. In particular, there is a risk of credentials being leaked or access to other users' data through prompt injection and similar attacks.

To address this, Notion adopted Vercel Sandbox. Each Worker runs inside a Firecracker microVM, providing a stronger level of isolation than containers. Every execution has its own unique kernel, file system, and network stack, and once execution finishes, the microVM is either destroyed or saved as a snapshot.

To support large-scale workloads, Vercel Sandbox offers the following key features:

• Credential injection: A firewall proxy injects API keys at the network level, allowing code to communicate with external services without directly accessing the runtime environment.
• Network policies: Network policies can be updated dynamically during runtime, enabling controls such as allowing internet access during dependency installation while blocking external communication during execution.
• Snapshots: File system state is saved and restored via snapshots, enabling fast cold starts.