Lua sandboxing is a bit different task. You can easily define, which functions are available and which are not. Thats a feature of Lua. If you give it full power and access to the hosting computer, there is nothing it can't do. I can't remember any game, with inbuilt scripting, that gives this kind of access. Account data can be accessed with keylogging and external softwares that the Lua can download and run. I get what you are saying, but that is not how people works Average internet user is dumb and 50% are worse than that. So, to make it absolutely clear what my thinking could mean. Lua os and io library needs restrictions. At minimum, notification that the script can run anything on your computer, delete any files it sees fit and send all your data to internet. They can easily block the obvious ones and/or write a wrapper that replaces the original function, to restrict it. I too, would like to get my hands on fully powered Lua, but I don't think it should be the default.