This scared me even more than all the other security issues (like hot reloading of plugins, permissions not being followed, etc.).

A vibe coded minimal JavaScript interpreter? This sounds dangerous af.

With several thousand of open issues on GitHub already.

Are we just ignoring security when it comes to harnesses?