A developer implements client-side feature flags by checking a variable like 'window.__FEATURES__.ADMIN_PANEL = true'. A tester enables the admin panel by running this in the browser console. What is the core security issue?

• A.A frozen window object blocks the tester from editing the flag after the page loads; the variable then protects the admin panel from all users who open the console in any browser that runs the application on a shared computer
• B.The flag name is visible in the bundle; renaming it with a random identifier on each release removes all risk from the console edit by the tester
• C.Console edits are sent to the server by a beacon; the audit trail then alerts the security team to all testers who change a flag in the UI
• D.Client-side feature flags are a UI convenience only; any server-side actions performed when the admin panel is shown must independently authorize the user - the flag itself provides no access control