The fix I would put above per-task scoping: keep the tokens out of the sandbox entirely. A credential proxy outside the sandbox holds the real Gmail or GitHub token and adds it only to outbound requests for the named API hosts. Code that gets execution inside finds a placeholder, so a reverse shell has nothing worth taking. Docker's new Sandbox Kit spec describes this pattern, with only a sentinel value inside the sandbox. It also gives you a real stop in place of a late warning, because the proxy can refuse a call before it leaves.