Thread:Extension talk:CirrusSearch/Is it possible for CirrusSearch to NOT require dynamic scripting?

I've set up an ES cluster for use in my organization for both Logstash and Mediawiki search. I'm learning that having dynamic scripting enabled presents a sizable security risk. Therefore, to keep the security tight and attack surface to a minimum, it seems I might have to run a dedicated and locked-down ElasticSearch instance (or cluster) to service CirrusSearch query requests only.

Is there another approach that CirrusSearch could use (perhaps preloaded, parameterized scripts?) that could eliminate the need to run with dynamic scripting enabled?