excessive-data-exposure-anti-pattern

To prevent sensitive data exposure in API responses, implement explicit Data Transfer Objects (DTOs) or field-level filtering to ensure only permitted data is transmitted, avoiding the serialization of entire database objects.

Excessive data exposure in API security occurs when an endpoint returns entire database objects, accidentally leaking sensitive or unnecessary fields like passwords or PII to the client.

You can audit API endpoints for sensitive data leaks by reviewing serialization logic to identify and flag instances where sensitive fields such as password hashes or PII are included in client responses.

Yes, you need explicit DTOs or explicit field-level filtering to secure API serialization, ensuring that backend responses only include necessary data rather than automatically serializing full database records.

Field-level filtering stops unnecessary data transmission in web services by explicitly selecting only permitted fields during serialization, preventing backend objects from returning sensitive or unneeded data to the client.

Your API returns password_hash fields because the endpoint is serializing entire database objects instead of using explicit DTOs, causing sensitive fields to be automatically included in the API response.