The notion of 'securing part of a runtime' is essentially a fallacy. 'Sandboxing' anything really is quite hard. If you want to make a firewall between blocks

The notion of 'securing part of a runtime' is essentially a fallacy. 'Sandboxing' anything really is quite hard. If you want to make a firewall between blocks of untrusted code, they have to be run in completely isolated from one another, which creates a lot of overhead. I don't see anyway to mix untrusted with trusted code. If some of your code is untrusted, it's all untrusted. We probably need an operational situation to this, which is, you pay a fee to some org that literally sits there and pours through the code to look for hacks, and there's some verification & oversight a to who is submitting what. etc.. It may very well be that the days of regular open source are over, there might have to be some changes to it. I can imagine in 10 years from how, all you telling junior devs about the 'good old days' when people just randomly put some code up on a site, and you used it! They will hardly believe you. "That's crazy, a few line of bad code could wipe out your company!".