I&#x27;m a big fan and user of Luajit, and as much as I understand the problem of &#x27;trusting&#x27; loading files around, in the case of LuaJIT anyone using the API would be &#x2F;crazy bonkers&#x2F; to load code from anywhere else than a very specific, very closed source base.<p>Luajit has FFI, that allows you you to call back into any C code, libraries, structure and so forth, so by definition you KNOW the LUA you run in LuaJIT is not &#x27;safe scripting&#x27; but more or less part of the running process, with no barrier (and thats part of the beauty of it).<p>The good news is, you 1) can&#x27;t easily load lua files in LuaJit and 2) can make your own &#x27;loader&#x27; in your LuaJIT application that can match a hash for anything you load, before it&#x27;s loaded - it&#x27;s fairly trivial in fact.<p>So that article could be replaced by search&#x2F;replacing with something like &#x27;if you load a dynamic library in C and dybload() a symbol and call it, it CAN BE NASTY!&#x27; well yeah, it can. Don&#x27;t trust external code, otherwise someone will make a clickbait out of you :-)