Currently a "user" having rights to deploy additional elements could inject code in pageboard. Use https://github.com/laverdet/isolated-vm to avoid that.