You are reviewing an Entity Framework application to ensure that it adheres to security best practices. You need to identify coding practices that present a security risk.

Which practice do you identify?

Avoid returning IQueryable types from methods that are exposed to potentially untrusted callers. A consumer of a query that exposes an IQueryable type could call methods on the result that expose secure data or increase the size of the result set. Use the return type IEnumerable and call a method (such as .ToList()) that materializes the IQueryable results.

Lazy loading in itself presents no security best practice violations.