Solved by ptrblck in post #3 
              
              
                Additionally to what @albanD said, I think you could try to secure your environment by e.g. running submissions in a container (singularity or docker) without any permissions, which could affect your bare metal systems. Of course a system is never 100% secure and in the worst case users might try to…