The documentation for SimpleEvaluationContext states that it should be used for "categories of expressions that do not require the full extent of the SpEL language syntax and should be meaningfully restricted", and the documentation for StandardEvaluationContext says to "consider using SimpleEvaluationContext instead" for data-binding purposes.

However, we should explicitly state that StandardEvaluationContext should not be used to evaluate untrusted input, and we should document the general security implications of evaluating untrusted SpEL expressions.

NOTE: This issue is assigned and therefore not suitable for community contributions.