I have had my own version of this for about a decade, but the "disable coredumps to disallow leaking secrets" idea is a good one. I'm mostly using bwrap for things these days with my own wrapper, but I never thought about if bwrap can leak a coredump. Although I guess without access to the coredumps it's not a big deal.