Index: src/tools/wasm-opcodecnt.cc
--- src/tools/wasm-opcodecnt.cc.orig
+++ src/tools/wasm-opcodecnt.cc
@@ -24,6 +24,9 @@
 #include <map>
 #include <vector>
 
+#include <err.h>
+#include <unistd.h>
+
 #include "src/binary-reader-opcnt.h"
 #include "src/binary-reader.h"
 #include "src/option-parser.h"
@@ -144,6 +147,13 @@ void WriteCountsWithImmediates(Stream& stream, const O
 int ProgramMain(int argc, char** argv) {
   InitStdio();
   ParseOptions(argc, argv);
+
+  if (unveil(s_infile, "r") != 0)
+    err(1, "unveil: %s", s_infile);
+  if (s_outfile != NULL && unveil(s_outfile, "wc") != 0)
+    err(1, "unveil: %s", s_outfile);
+  if (pledge("stdio rpath wpath cpath", NULL) != 0)
+    err(1, "pledge");
 
   std::vector<uint8_t> file_data;
   Result result = ReadFile(s_infile, &file_data);
