What is the performance risk of @PostFilter, and how do you avoid it?

@PostFilter is applied AFTER the annotated method has already returned its full result set (e.g., every row from a table), filtering the in-memory collection down afterward — meaning the database (or other resource) does the work of fetching data that will just be discarded. The better approach, whenever possible, is to push the filtering condition into the actual query itself (e.g., a repository method scoped by the current user), so the database only returns rows the user is allowed to see in the first place.