prowler/api/changelog.d/attack-paths-custom-query-comment-bypass.security.md

Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so LOAD CSV can no longer be split with a comment nor its response returned under a forged provider label