If we want to run user-supplied code, we have a few different options to explore
- Properly sandboxed WebAssembly (with strict memory and CPU limits)
- Running code in an iframe-webworker (and setting the iframe rules to be as strict as possible)
- Running code in a super sandboxed manner (like https://github.com/endojs/endo )
- Having a "trust" button, that lets the user run arbitrary code (preferably signed code or something?)
- Using a language with a linear runtime as much as possible (see https://github.com/google/cel-go )
If we want to run user-supplied code, we have a few different options to explore