[CHANGELOG] Introduce the experimental sandbox feature.

CHANGELOG.md

@@ -6,6 +6,31 @@ To install or update CocoaPods see this [guide](http://docs.cocoapods.org/guides
 
 ###### Enhancements
 
+* Introduces an experimental sandbox feature.
+  [#939](https://github.com/CocoaPods/CocoaPods/issues/939)
+
+  Let’s face it, even though we have a great community that spends an amazing
+  amount of time in curating the specifications, the internet can be a hostile
+  place and the community is growing too large to still take a naive approach.
+
+  As such, we have started leveraging OS X’s sandbox facilities to disallow
+  unsanctioned operations. This is still very experimental and therefore has to
+  be used explicitely, for now, but that does **not** mean we don’t want you to
+  start using it and **report issues**.
+
+  To use the sandbox, simply use the `sandbox-pod` command instead. E.g.:
+
+      $ sandbox-pod install
+
+  In case of issues, check `/var/log/system.log` for ‘deny’ messages. For
+  instance, here’s an example where the sandbox denies read access to `/`:
+
+      May 16 00:23:35 Khaos kernel[0]: Sandbox: ruby(98430) deny file-read-data /
+
+  **NOTE**: The above example is actually one that we know of. We’re not sure
+  yet which process causes this, but there shouldn’t be a need for any process
+  to read data from the root path anyways.
+
 * Documentation generation has been removed from CocoaPods as it graduated
   to CocoaDocs. This decision was taken because CocoaDocs is a much better
   solution which doesn't clutter Xcode's docsets while still allowing