What counts as two safety mechanisms?

> you can afford untrusted input and no sandboxing.

I would not trust a rust program un-sandboxed! There are security bugs in rust itself.