Sandbox

Scripts run in a restricted Lua 5.4 environment. Only a curated subset of the standard library is loaded, anything that would let a script touch the filesystem, the OS, or load arbitrary modules is blocked. Network access is provided through a separate curated API that can be disabled from the menu.

Loaded libraries

• base, core language functions (type, pairs, pcall, tostring, error, etc.)
• math, math functions (sin, cos, sqrt, floor, random, etc.)
• string, string manipulation (find, format, sub, gsub, match, etc.)
• table, table operations (insert, remove, sort, concat, unpack, etc.)
• coroutine, coroutine control (yield, resume, create, wrap, etc.)
• utf8. Unicode string handling (len, codes, char, codepoint, etc.)

Blocked libraries

• io. No file read/write
• os. No os.execute, os.remove, os.clock, etc.
• package. No require paths or module loading
• debug. No debug.getinfo, debug.sethook, stack inspection

Common replacements

When you'd reach for a blocked standard library, the cheat usually has a curated alternative:

• Need to persist data? Use Storage instead of io.
• Need timing? Use the global clock() function instead of os.clock.
• Need network access? Use the HTTP library, opt-in, kill-switchable from the menu.
• Need modular code? Inline it. There's no require; each .lua file is its own self-contained script.