Zendesk's engineering team writes about its production systems, including Go, Ruby and Kafka, TensorFlow serving, GraphQL tooling, and logging.
HN commenters link it mainly as an example of Zendesk's engineering work, such as the SimpleDB post; no strong opinions appear in the given comments.
(Author here)
There is material on the internet that are relevant to the topic, but it's quite hard to piece together. After all, there are only a handful of players right now who need to build an API that isn't a REST API.
Among big names, I can think of Zendesk (uses iframes), Coda (runs third-party code on their servers IIRC, isolated via server mechanisms), Salesforce (not sure exactly what they do, but I think they also use Realms as a component to their system).
https://medium.com/zendesk-engineering/sandboxing-javascript-e4def55e855e
https://trailhead.salesforce.com/en/content/learn/modules/lex_dev_lc_vf_tips/lex_dev_lc_vf_tips_javascript
There's a couple of academic papers on JavaScript isolation, but you'll have to do a lot of work to figure out how relevant they are. Be sure to check the publication date.
The folks at Agoric are probably the leading experts actively working on untrusted code isolation in a browser environment right now. I would follow them if you want to hear about the latest new tech: https://github.com/Agoric/SES
Ah hah - but see https://medium.com/zendesk-engineering/resurrecting-amazon-simpledb-9404034ec506