Lua is extremely sandboxable from hosting C. Just only add modules, functions and features you want added. Makes good use of the C preprocessor flags too. But also check out QuickJS as a neat alternative. But it probably doesn’t compare in speed to LuaJIT which is mostly the flavor used I think.