---
title: Script contexts unrestricted
description: Describes what AutoOps detects and surfaces with the Script contexts unrestricted insight: All script contexts can run: `script.allowed_contexts` is unset.
url: https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch/script_contexts_unrestricted
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud on Kubernetes
  - Elasticsearch
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Elastic Cloud on Kubernetes: Generally available
  - Elastic Cloud Enterprise: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Script contexts unrestricted
All script contexts can run: `script.allowed_contexts` is unset. Scripts might run in search, ingest, update, aggregations, and other contexts.
<note>
  For a complete list of insights, refer to [AutoOps insights](https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch).
</note>


## Insight details


| Field     | Value                        |
|-----------|------------------------------|
| Component | Elasticsearch                |
| Severity  | Medium                       |
| Scope     | Cluster                      |
| Domains   | performance, security-safety |


## Example: What you might see in AutoOps

The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.

### All script contexts are allowed


#### What was detected

`script.allowed_contexts` is unset, so scripts can run in every context. Current value: inline, stored.

#### Recommendations

<note>
  AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
</note>

<dropdown title="Restrict allowed script contexts">
  **Condition**: Always shown for this insight.Set `script.allowed_contexts` to the contexts your applications need (for example search, ingest, or update). Do not set `none` if Kibana, ingest, or search scripts must run. Add the setting in `elasticsearch.yml`, then restart the node.
  <note>
    Unset means all contexts. `none` blocks every context.
  </note>
</dropdown>


#### Background and impact

`script.allowed_contexts` controls where scripts might run. When the setting is unset, Elasticsearch allows all contexts.
A broad context list increases load risk and the chance that scripts run in paths you did not intend. Set an allowlist of the contexts you actually use.
`none` blocks all script contexts. Do not use it if Kibana, ingest, or search scripts must run.

## Guide

[Scripting and security in Painless](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/scripting/modules-scripting-security#allowed-script-contexts-setting)