Panels and menus are executed with the context of the main document viewed

Panels and menus are executed in the context of the main document. This raises a security problem.

Scenario:
1) a user with edit rights but no programming rights adds some Groovy code into a panel
2) the user then browses a document whose last author has programming rights

Then the Groovy code inserted in 1) is executed, whereas it should not since the author has no programming rights.