It's also worth noting that the bundle that includes the Lua code is signed and its signature gets verified by the OS before running.