This is really cool! How are you sandboxing the tiles and allowing limited JS execution?

I'm using JS-Interpreter project: https://github.com/NeilFraser/JS-Interpreter . It's slow, but easy to add and work with.