A sandboxed task reads what it depends on, and nothing beside it
A sandboxed task reads what it depends on, and nothing beside it
A sandboxed task can read the outputs of the tasks it depends on, in any project, and never their sources. With hermetic: true it reads nothing of the machine you did not name.