Constraint velocity scripts

--000000000000d71d0c05edb3bb9c
Content-Type: text/plain; charset="UTF-8"

From what i understand, velocity scripts basically allow someone to call
any valid java code or velocity tag. Is there any api or some plugin
infrastructure that exists and i could use to constrain which classes can
be called by velocity?

For example, i want to prevent API calls to java.net.URL or perhaps
whitelist a set of classes or tags that a user can execute via velocity. is
this a thing?

--000000000000d71d0c05edb3bb9c--