Lua supports sandboxing via its _G variable, i.e., implicit global scope. When you call a script, you can pass it a custom _G.