Audit my app for mass assignment vulnerabilities. Look at every endpoint that creates or updates a record, especially ones that spread or assign the request body directly into a database write (patterns like update(id, req.body) or Object.assign(record, payload)). For each one, replace bulk assignment with an explicit allowlist of fields the client is permitted to change. Fields like role, is_admin, plan, balance, price, user_id, and created_at must never be writable from the request body. If different user types can change different fields (a user edits their profile, an admin edits roles), split the allowlists per role rather than widening one. Do not change which fields users can legitimately edit in the UI. Do not rename request or response fields. Keep the API contract identical for legitimate clients. Give me a table of every create/update endpoint, the fields it accepted before, and the allowlist it enforces now. Include a test I can run: submit a profile update that also includes { "role": "admin" } and confirm the extra field is ignored or rejected.