Closing as work got done and nothing new has happened for a while.

However, I invite those interested in the Lua security model to comment on bug #19729; we need some sort of answer for 2.4.0.

API: Hide Lua module 'debug'

We load the debug library, but do not make it available in the
Lua API. The debug module allows access to (among other things) the
registry, and upvalues (local variables of closures).

See gna bug #15725

(Browse SVN revision 17341)

Here is a plan:

No unsafe functions (should be done)

No NULL pointers and no wild pointers (in progress):
1. We check arguments everywhere. Script functions should try to assure success or raise a script error.
2. Debug module hidden to disallow access to stuff that we hide (below)

No NULL pointers and no wild pointers (planned):
3. Limit access to the 'tolua' module (tolua.cast etc)
4. Remove access to all the API types' metatables (The table ".get" contains unprotected C function calls to look up object fields (.id, .name, .owner etc). Remove access to ".set" (all fields should be read-only, objects will be mutable by adding methods/setters instead)

Are these goals too ambitious? In particular, item 1 is much more ambitious than it sounds like. (Depending on the API function of course).