Ideally we'd just keep each mod in a separate lua_State
and make mods pass data amongst themselves through a Minetest API. This would improve security and probably make mod-level multithreading easier, but it would break just about all mods. Without this we're limited to a "best guess" as to what mod is running. During init time this guess is fairly accurate, but after init time it's a mess.
For example, even at init time I think the following sandbox escape is possible (although I haven't actually tested it):
minetest.conf:
secure.trusted_mods = trusted
mods/trusted/depends.txt
untrusted
mods/trusted/init.lua:
untrusted()