The goal: you (any programmer) should be able to use an open-source program, get an idea for a simple tweak, open it up, orient yourself, and make the change you visualized -- all in a single afternoon.
More details: http://akkartik.name/about
What I have so far: https://github.com/akkartik/teliva
Lately I'm spending a lot of time thinking about the sandboxing model. I'm giving a talk about it at FOSDEM this weekend: https://fosdem.org/2022/schedule/event/lastmilesandboxing
As a concrete stress test, consider a file browser like Midnight Commander (https://news.ycombinator.com/item?id=30137864). How would you craft policies for a file browser that give it just the permissions it needs to scan directories and open files, but prevent malicious code that creeps into it from scanning directories or opening files?