How to Build Extensible Web Apps with Sandboxed LLM Plugins

Every SaaS founder eventually hits the feature request treadmill. One enterprise customer needs a custom CSV exporter, another wants a highly specific webhook formatter, and a third demands a custom data-validation rule. Building these bespoke features internally drains engineering momentum, while offering a generic "no-code" builder often results in an expensive, fragile UI that users still find limiting.

A new architectural pattern is emerging to solve this: Extensible Software. As highlighted by technologist Jeremy Morrell, LLMs radically lower the cost of authoring custom software extensions, while modern sandbox primitives lower the deployment cost and provide secure boundaries. Instead of building every edge case, teams can build a solid, accountable core application and allow users to safely run LLM-generated code to handle their own custom workflows.

The Security Risk of User-Generated Code

While letting an LLM write custom JavaScript for your users sounds ideal, executing untrusted code on your infrastructure is historically dangerous. Even modern cloud environments face challenges; for instance, Cloudflare's ongoing research into remote Spectre attacks on Workers infrastructure demonstrates how sophisticated side-channel attacks can target shared execution environments. If a multi-billion dollar infrastructure provider must constantly harden its defenses against CPU-level leaks, a small product team cannot afford to run raw, un-sandboxed user code on their primary servers.

To make extensibility viable for lean teams, you must run user-created scripts within strict, isolated boundaries. This means leveraging lightweight sandboxes that execute either directly in the user's browser or within highly constrained, short-lived serverless isolates.

A 4-Step Guide to Implementing Safe LLM Extensions

You do not need an enterprise-grade platform to offer user-programmable extensions. By combining a structured LLM prompt with a secure client-side or server-side runner, a small team can implement this feature in a few days.

1. Define the input-output boundary: Do not give user scripts free access to your database or APIs. Instead, define a strict, JSON-serializable schema. For example, if a user wants a custom data transformer, your core app should pass a flat JSON object to the script and expect a flat JSON object back.
2. Establish the sandbox environment: For simple data transformations, run the code in the user's browser using a heavily restricted iframe with the sandbox attribute enabled, or use a WebAssembly-compiled JavaScript runtime like QuickJS. If server-side execution is required, use isolated, short-lived V8 isolates with all network access disabled by default.
3. Embed the LLM code generator: Provide a simple UI prompt where users describe what they want their extension to do (e.g., "Parse the incoming payload and capitalize all email addresses"). Pass this prompt to a fast, low-cost frontier model. Instruct the model to return only a single JavaScript function matching your predefined signature, without any external dependencies.
4. Enforce strict execution limits: Set a hard timeout on script execution (such as 50 milliseconds) and limit memory consumption. If the LLM-generated script enters an infinite loop or attempts to exhaust system resources, the sandbox must immediately terminate the process without affecting the core application.

Who Should Adopt This Today?

If you run a B2B SaaS platform where customers constantly ask for custom integrations, data formats, or automation rules, this approach can eliminate a massive portion of your product backlog. It shifts the burden of customization from your engineering team to an on-demand AI assistant, while keeping your core codebase clean and maintainable.

However, if your application handles highly regulated financial or medical data, you should wait or restrict execution strictly to the client's local browser sandbox. The risk of data leakage via malicious prompt injection—where a user is tricked into pasting a prompt that exfiltrates data—requires rigorous input validation and content security policies.

The Core-and-Extension Takeaway

The future of web software is not a massive suite of rigid features, but a lean, dependable core surrounded by highly flexible, AI-authored extensions. At Presence Digital, we advocate for keeping your primary application architecture simple and delegating edge-case customizations to sandboxed, automated environments. Build a rock-solid core, let the LLM handle the custom logic, and keep your sandbox locked tight.