[chc4]

WASM and Wasmer are not intrinsically anymore secure, except for simplicity, than any other editor plugin system. Vimscript and Emacs-lisp basically have the same security characteristics as using WASM for plugins. It's not a step in any direction, except for whatever environment Zellij exposes to the plugins by default.

[maxmcd]

I'm not sure how this is true. I don't know anything about vimscript and emacs-lisp plugin systems, but at a cursory glance it looks like plugins might be able to do things like launch shell commands?

Zellij seems to be using WASI, a standard set of syscalls. Currently, wasi syscalls (or at least the version of wasi that is running in wasmer) can't really access the network, can't fork/exec, can provide a chroot view of the filesystems (without root access), can limit access to certain types of functionality. These kind of secure defaults seem like an improvement to me compared to most plugin systems I'm familiar with.

Maybe vimscript/emacs-lisp has these things.