It's an experiment, an opportunity to learn how this stuff works. So far all is well. Before making an investment in any particular security scheme, I need to understand what the application is. That's why I want a safe incubator for this idea, to play and experiment and learn. If so, the simplest security would just be to disable all file system verbs from embedded scripts.
People are right, scripting is very powerful.
So for now, that power is reserved for me, personally. Yesterday the whole thing got real interesting with Sun's announcement of their deal with Netscape to embed the Java language in Netscape's web browser. It's good to know that an established technology vendor like Sun can ally itself with an aggressive startup like Netscape. Anyway, Java sounds cool. I want to write Java scripts, and make them work with my Frontier worm scripts, CGIs, embedded ones, etc.