Bigger than XSS, I think that would create API rot (though I think Google is going in that direction already.) The only thing worse than having a proprietary A

Bigger than XSS, I think that would create API rot (though I think Google is going in that direction already.) The only thing worse than having a proprietary API to interact with your application is to have a proprietary API that can only be run from a proprietary sandbox. On the other hand, Google could make APIs publicly available so someone running on whatever platform could easily call them. This doesn't solve the security problems, but if Google can't trust external people with the API a sandbox isn't going to do a lot of good.