Why a FastAPI endpoint happily sends back fields you never meant to expose, and the one line that filters them out.

The endpoint looked harmless. Fetch a user, return the user.

@app.get ( " /users/{user_id} " ) async def get_user ( user_id : int ): user = await db . get_user ( user_id ) return user

Enter fullscreen mode

Exit fullscreen mode

It worked. It returned the user's name, email, everything the frontend needed. Nobody looked twice.

Weeks later, someone opened the browser network tab while debugging an unrelated issue and went quiet. The JSON response for that endpoint had a field none of us wanted anyone to see.

{ "id" : 42 , "username" : "anna" , "email" : "[email protected]" , "password_hash" : "$2b$12$Q9...." , "is_admin" : true , "internal_notes" : "flagged for review" }

Enter fullscreen mode

Exit fullscreen mode

The password hash. The admin flag. An internal notes field.…