Security Finding (2.6) SEC-024: remove() Calls flush() Twice

[DyanGalih]

Finding ID: SEC-024
Location: lib/Repository/AbstractRepository.php
CVSS: 2.6

remove() calls flush() directly, and the service layer's commit() also calls flush(), leading to double flushes and possibly duplicate lifecycle callbacks.

Impact: Inefficient persistence operations and unexpected lifecycle behavior.

Remediation (short): Let callers control flushing; remove the flush from remove() and document transactional behavior.

Reference: SECURITY_REVIEW.md