A server-rendered page serializes a full customer record into a client component and uses a project-only shared cache key. Identify two independent risks.

Unneeded serialized fields are exposed to the client even when not rendered. A shared key that omits caller/account dimensions can serve private content or permissions in the wrong context. Return permitted fields and apply an appropriate cache policy plus server authorization.