I made tests today in isolation of Lua files with Lua code and C API.
Using C API is too complex as it needs to copy each variable manually. I will use the loadfile function with a copy of global variables, so the plugins can't override other plugins variables.
The unsafe functions will be disabled globally and not only for plugins. An API will be added to allow plugins write/save files which let the user choose the destination file, and another one for settings.