Mods run deny-by-default. Only the standard Lua listed below is available, plus the engine APIs on this page. There is no raw filesystem, process, or code-loading access — write files through data. All mods share one global environment (globals, functions, and hooks cross mod boundaries — like GMod); only data, MOD_NAME, MOD_VERSION, MOD_SOURCE, log, print, LOG_LEVEL, clipboard, net and shader are per-mod.
print, pairs, ipairs, next, type, tostring, tonumber, select, error, assert, pcall, xpcall, setmetatable, getmetatable, rawget, rawequal, rawlen, and the string, table, math, coroutine, utf8 libraries.
A time-only subset: os.time, os.date, os.clock, os.difftime. (No execute, remove, rename, getenv, exit.)
Only the verbs that ask, never the ones that tune: "collect", "step" (with an optional size in KB) and "count". A mod that has just released a lot of memory — a recorder finishing a take — can hand it back at a moment of its choosing instead of waiting for the collector to notice. "setpause", "setstepmul", "incremental", "generational" and "stop" are refused: the sandbox is shared, so one mod retuning the collector would retune it for every mod in the process.
Removed entirely. These are the usual ways to escape a sandbox — file I/O goes through data, and there is no runtime code loading.
Opens native modules - DLLs in bin/, reviewed before anyone can download them - and nothing else. It does not load Lua files.
Removed, while rawget, rawequal and rawlen stay. camera and account are read-only faces: an empty table whose metatable resolves reads through __index, refuses writes through __newindex, and hides itself so setmetatable cannot reach it. rawset walked straight past __newindex, and a raw key on the empty face shadows __index — so one mod could have replaced account.signedIn for every mod in the shared sandbox. The read-only raw accessors cannot forge anything and are untouched.
These exist, but not for mods. They change the user's device, window, volume, installed mods or sign-in state, and auth additionally holds the session tokens — in a sandbox shared by every mod, one of these reachable would be all of them reachable. network is what the user answered about every mod's connections, and its forget would let a mod ask again forever. The slices mods do get are camera (what the card reports), account (who is signed in), and sound.play (one-shot playback that follows the user's volume, never changes it).