Audit my API responses for over-exposure. Look at every endpoint that returns a database record (user profiles, orders, comments with author info) and check whether it returns the whole record or a deliberate selection of fields. The classic bug: the endpoint fetches the user document and returns it whole, so the response includes password hashes, email addresses, phone numbers, internal flags, roles, and stripe customer IDs, even though the UI only displays a name and avatar. For each endpoint, define an explicit serialization step (a DTO, a projection, or a field allowlist) so only the fields the client needs leave the server. Apply it to nested records too, like the author object embedded in each comment. Do not change what the UI displays; the responses should shrink to what the UI actually uses. Do not remove fields other parts of the app consume without checking usage first. Deliver a table: endpoint, fields returned before, fields returned after, and anything sensitive that was leaking. Include a curl command per endpoint so I can confirm the sensitive fields are gone from the actual responses.