What are the limitations of Query Entity?
Discussion posts and replies are publicly visible
That's a bit of a vague question - maybe start with this documentation and work through the documentation for each of the functions used as parameters?