---
title: "Return only the fields needed · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields
updated: 2026-10-20
licence: "All rights reserved"
---

# Return only the fields needed

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
- How: Build each reply from an explicit list of fields. Never return the stored object directly. Keep separate lists for the owner, other users and staff.
- Check: The agent reads replies about other users as a normal user. It finds no email address, password hash, internal note or field the page never shows.

Example:

```js
// Good: name the fields
res.json({ id: user.id, name: user.displayName });
// Bad: everything in the record, including the password hash
res.json(user);
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields`.

- Previous: [Serve no hidden files](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files)
- Next: [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)