# Security and sandboxing

<PageBadges />

Expressions are evaluated by form0-core in a configurable security mode.

## Modes

- `TRUSTED`: Full JavaScript access (default).
- `SAFE`: Restricted globals and blocked patterns.
- `CUSTOM`: User-defined rules.

## Safe mode defaults

Safe mode blocks patterns like `eval`, `Function`, `window`, `document`, `process`, `require`, and
other unsafe globals. It also limits execution time and call stack depth.

## Using a security config

```js
import { createFormEngine, SAFE_SECURITY_CONFIG } from "form0-core"

const engine = createFormEngine({
  schema,
  security: SAFE_SECURITY_CONFIG,
})
```

Security config is used for calculated fields and event code.