Auditing, supply chain security, and sandboxing are related.
For the code running outside of the sandbox, you do a direct code audit of your own code and vendored code, as well as a supply chain audit of the dependencies.
For the code running inside the sandbox, you assess what auditing is necessary (typically less than the auditing outside of the sandbox) and do that as well.
