Security Finding (5.3) SEC-018: Query Cache Disable via Query String

[DyanGalih]

Finding ID: SEC-018
Location: lib/Util/CacheFactory.php
CVSS: 5.3

Any authenticated user can disable query caching by adding a query string parameter, which can be abused to create a DoS by bypassing cache.

Impact: Denial-of-service risk and increased DB load.

Remediation (short): Restrict this capability to dev or admin-only requests, or remove it entirely in production.

Reference: SECURITY_REVIEW.md