Currently, the Codengine Sandbox prevents access to the XMLHttpRequest object. You can test it by uploading this file to the site.
The link below leads to an external site.
The sandbox replaces those urls to a confirmation page.
The sandbox blocks alert() popups when it is called more than 3 times during ONE event.