are these typically just data queries? how do you get past arbitrary code vulnerabilities?

this is something i'm exploring today with: https://nux.ai/

which has a similar experience (run code within the browser)