WebAssembly Sandbox Security Simulator

WebAssembly runs untrusted bytecode at near-native speed, but only inside a strict security model. This simulator visualizes a WASM module executing inside its own bounded linear-memory region, wrapped in a capability-gated sandbox wall. Normal operation writes sequentially into memory pages and calls host functions the module was actually given — imports like console.log and math.sqrt succeed as green beams, drawn from a ring of host capabilities around a central runtime core. Trigger a simulated memory-overflow attempt to see a rogue write trapped exactly at the edge of the linear-memory block, or an unauthorized syscall attempt to see a call to a function outside the import table rejected before it ever reaches the host. Toggle fs.open and net.connect live to see the host grant or revoke a capability, while process.spawn stays permanently locked — a reminder that WASM has no raw system-call instruction at all.