[fsfod]

I personally just went down the route of stripping down the FFI system when integrating LuaIT. It included things like removing the ability to define new ffi types\functions or loading libraries, as well as removing most casting and pointer indexing.

[LoganDark]

Make sure to also remove any way to load bytecode. Luau has a good page on what they've done in pursuit of sandboxing: https://luau-lang.org/sandbox (it's also a good alternative to consider if ever you don't need LuaJIT specifically)