Applicants for software engineering jobs sometimes go through coding challenges as part of the interview process. The company may send applicants code and a development task with a deadline, and applicants send back the code with modifications based on the development task.
How do companies presenting these coding challenges securely test the code they receive from applicants? Of course applicants could have the same question, how do they securely work on the code sent to them, but given the applicant reaches out to an established company I imagine the companies are more trustworthy in this situation. What precautions should be taken to safely open, explore, and run the code that someone barely known submits?
A good example of the code in question is an entire Visual Studio solution of ~100,000 lines of C++ code, with the dev task requiring modification or addition of within 100 lines throughout that solution.
Maybe the answer is simply a matter of trust but I wonder if there are technical precautions companies take to ensure no applicants can get malicious code running on the company's computers. I tagged virtualization and sandbox because Virtual Machines seem like a reasonable way to sandbox the code in question, but if testing the code requires the computer doing the tests to have extensive and expensive software installed, is this still the appropriate or only method? Are there any kind of anti-malware scans reliable in this case?