This can only open files in luafiles/ and its subfolders, and only a few file extensions are allowed.
The primary function for opening a file in read mode is
io.open(string filename, string filemode, function callback),
which is just like the one from vanilla Lua, except instead of returning a file handle,
the host first sends the file to every client, and then call the callback for everyone.
The callback is of the following form: function(file, filename).
Inside the callback, you can just use the regular I/O functions like base Lua.
The file is automatically closed after the callback returns.
Currently, only files on the server's side can be opened in a synced way, although I might decide to change that in a later patch.
For writing to a file, you can use the io.openlocal(filename, filemode) function,
which behaves exactly like io.open() from vanilla Lua (safe for the luafiles/ and whitelist restrictions).
Less importantly, io.openlocal() can be used for reading a file locally,
although this is only to be used in exceptional circumstances, such as reading a list
of passwords without sharing them with the clients, etc.
For extra safety, clients can only open files that are in luafiles/client/ and its subfolders.
...And of course io.popen is gone :V