This is not 100% correct, the answer given by KMT is right when it comes to the Apple policy, you can not download Code and execute it, but this is quite subjective.
For example, if you are running a phone gap application, then most of your code is packaged, but you still go to the server to get data, most of the data might be json format, images etc, but you can also get rendered content such as browes to a web site, and this is downloaded and the javascript is executed.
In the LUA side of things, you can do the same, but it must be more subtle, for example, you can download, store and use data, such as images, text f iles etc, and lua has the capability to save a filename.lua file to the working folder and the require it to execute its code. But your base app still needs to be a packaged deployment. if you include the luac then you can do this, as the luac is needed to compile the script on loading, but without it, you need to have pre-compiled lua scripts downloaded.
Moving forward. more double standards, if you look in the app store you can find various scripting programs, one of them is lua, and in the app you can edit script and execute it. So basically, if you package the app, and the API to offer the app functionality, and not download scripts or have the capability of the app to do something that was not in the breif, then Apple will look favourbly at your app. on th eother handm do somthing that makes you stand out, break the app so people send many bug reports to apple, then they will black list you.
