Six layers to sandbox untrusted Python — and the escape I missed

Letting users run their own Python to shape your server's responses means executing untrusted code in production. Here are the six independent layers that contain it, why each exists, and the AST-bypass that slipped through all the early ones.