diff --git a/cdap-common/src/main/resources/cdap-default.xml b/cdap-common/src/main/resources/cdap-default.xml
index 02e938e88ec4..ccc3b4ec4545 100644
--- a/cdap-common/src/main/resources/cdap-default.xml
+++ b/cdap-common/src/main/resources/cdap-default.xml
@@ -6774,4 +6774,12 @@
     </description>
   </property>
 
+  <property>
+    <name>feature.wrangler.secure.jexl.enabled</name>
+    <value>false</value>
+    <description>
+      If true, Wrangler will enforce secure by default model for JEXL scripts 
+      in Wrangler directives allowing only whitelisted classes, methods and properties.
+    </description>
+  </property>
 </configuration>
diff --git a/cdap-features/src/main/java/io/cdap/cdap/features/Feature.java b/cdap-features/src/main/java/io/cdap/cdap/features/Feature.java
index 61fd9b3baff2..27f014aab39d 100644
--- a/cdap-features/src/main/java/io/cdap/cdap/features/Feature.java
+++ b/cdap-features/src/main/java/io/cdap/cdap/features/Feature.java
@@ -20,9 +20,12 @@
 import io.cdap.cdap.api.feature.FeatureFlagsProvider;
 
 /**
- * Defines Features Flags to be used in CDAP. Features take the version that they were introduced as
- * a first parameter. Optionally they can take a second parameter to define their default behavior
- * if they are not present in configuration. By default, features default to enabled after they are
+ * Defines Features Flags to be used in CDAP. Features take the version that
+ * they were introduced as
+ * a first parameter. Optionally they can take a second parameter to define
+ * their default behavior
+ * if they are not present in configuration. By default, features default to
+ * enabled after they are
  * introduced, and disabled before they were introduced
  */
 public enum Feature {
@@ -46,7 +49,8 @@ public enum Feature {
   NAMESPACED_SERVICE_ACCOUNTS("6.10.0"),
   WRANGLER_KRYO_SERIALIZATION("6.10.1"),
   SOURCE_CONTROL_MANAGEMENT_GITLAB_BITBUCKET("6.10.1"),
-  DATAPLANE_AUDIT_LOGGING("6.10.1");
+  DATAPLANE_AUDIT_LOGGING("6.10.1"),
+  WRANGLER_SECURE_JEXL("6.12.0", false);
 
   private final PlatformInfo.Version versionIntroduced;
   private final boolean defaultAfterIntroduction;
@@ -63,9 +67,12 @@ public enum Feature {
   }
 
   /**
-   * Returns if the feature flag should be enabled. First it checks featureFlagProvider to see if
-   * the feature flag has been defined. If not defined then it uses when the feature flag was first
-   * introduced, if the platform version is before or equal to when it was introduced it returns
+   * Returns if the feature flag should be enabled. First it checks
+   * featureFlagProvider to see if
+   * the feature flag has been defined. If not defined then it uses when the
+   * feature flag was first
+   * introduced, if the platform version is before or equal to when it was
+   * introduced it returns
    * false, otherwise it returns defaultAfterIntroduction.
    *
    * @param featureFlagsProvider provides which feature flags have been set.