By default, on-premises Reporting allows server-side scripting. Scripting enables report authors to embed C# scripts in reports. If you do not want to allow scripting, you can disable it.