A few years ago, I pondered the possibility of pluggable web applications, invoking St. Graham to solve the problem. As described by Chad Fowler, looks like Dabble, the Web DB, has taken a good stab at a web app plug-in mechanism. The gist is to plug-out, shipping off plain old CSV text to a URL, and receiving CSV in return. There must be some trickiness in avoiding DOS attacks, intentional or unintentional, but it's probably a bit easier than dealing with sandboxed code.
[Via Simon Willison]