Steps to reproduce:
1. Create new user.
2. Deny scripting right for the new user.
3. Log in with the new user.
4. Click Dashboard from App Panel
6. Add Velocity Gadget and write some code.
Code is executed.
The same works for User Profile dashboard.
The same for Python macro.