Agent WranglersData and secrets Required
Return only the fields needed
Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
How to do it
Build each reply from an explicit list of fields. Never return the stored object directly. Keep separate lists for the owner, other users and staff.
Example
// Good: name the fields
res.json({ id: user.id, name: user.displayName });
// Bad: everything in the record, including the password hash
res.json(user);How to check
The agent reads replies about other users as a normal user. It finds no email address, password hash, internal note or field the page never shows.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields.