No unnecessary data in responses (over-fetching)

Returning passwordHash, internal tokens, or entire database rows in API responses is a direct CWE-200 (exposure of sensitive information) finding and maps to OWASP A01:2021 (broken access control) when those fields reveal authorization state. A single mistakenly-included passwordHash field in a user endpoint hands an attacker every credential they need to mount offline dictionary attacks. Over-fetching also inflates response payloads and tightly couples clients to database schema, making schema changes more expensive (ISO-25010:2011 functional-suitability.functional-correctness).

Create a serializer at src/lib/serializers.ts that explicitly allowlists fields before returning database records. Never spread a database row directly into a response:

// src/lib/serializers.ts
export function serializeUser(user: User) {
  const { id, name, email, createdAt, role } = user
  return { id, name, email, createdAt, role }
  // passwordHash, internalFlags, stripeCustomerId are never included
}

In Prisma, add explicit select clauses to queries rather than fetching and stripping fields after the fact — this prevents the data from ever crossing the DB boundary:

db.user.findUnique({ where: { id }, select: { id: true, name: true, email: true } })