By "sandbox" I assume you mean the add-on package (.sdbx).  I'd never realised that was the meaning of "sdbx"!

Anyway, to answer your question, you can't prevent reports in the add-on replacing amended reports on site.

All you can really do is either remove them from the add-on packager for upgrades, or make the amended reports read-only,  or just warn the user to back up the "reporting\custom" folder first.

Thank you for the answer, Geoff. I assume its called sandbox because sdbx is like a short form for the word, and the fact it contain custom programs. And I have been calling it since I started with Sage 200 development.

I suppose one way you could approach this is by making your deployed report read-only, like many of the default Sage 200 reports. Then, if a user wanted to modify it, they would have to save it into a different location (like the Company folders under sage\reporting) or under a different name.

You need a bit of code to set the read-only flag on the report before you package it:

string filePath = @"C:\dev\my_custom_report.report";
var rep = ReportFile.LoadFile(ReportFileIOFactory.CreateReportFile(filePath, null));
rep.Flags |= Sage.Reporting.Model.ReportFlags.ReadOnly;
ReportFile.SaveToFile(rep, ReportFileIOFactory.CreateReportFile(filePath, null));

(By the way, SDBX actually stands for Sage DataBase eXtension. So now you know!)