The recent Rust zip CVE's make a great case study for secure, capability-driven Wasm Sandboxes. The blog is the long form; the linked GitHub has the code & demo.