I think I told someone back when that the safest program might just be ‘hello world’ in the safest language of your choosing.

And that came out more like a joke, but there really was a note on how to achieve an almost perfect sandboxing score in systemd. The trick is to not relax.