Categories//ntrol/The User Profile API

The User Profile API

beginner8 min60 pts

A junior dev on your team opened a PR for the user profile endpoints. The PM says it looks fine.

“Quick review? It's just a basic CRUD endpoint, should be straightforward.”

What you're being evaluated on

Identifying over-exposed fields - Which fields should never be in an API response?

Understanding data classification - PII vs public profile data distinction.

Spotting mass assignment - What happens when you pass raw request body to an ORM?

3 hints available (using hints reduces your score)

About this scenario

REST endpoint returning too much data. What should never leave the server? A junior dev on your team opened a PR for the user profile endpoints. The PM says it looks fine.

beginner · 60 points · 8 min · PII & Security

What you will practice

Identifying over-exposed fields - Which fields should never be in an API response?
Understanding data classification - PII vs public profile data distinction.
Spotting mass assignment - What happens when you pass raw request body to an ORM?

Play the full scenario above for free. More PII & Security scenarios · Create a free account to save your progress.