I'm not entirely sure what is going to happen with imports to be honest. My current thinking is that they'll be supported eventually but that imported modules should not have access to glide APIs. For anything that does need to use glide APIs, I would support that through a separate API.

Yes eval is blocked, and extensions / websites cannot access glide APIs.

Thanks that is very helpful! Agree those things should be mentioned in the security doc.