Sorting by a hidden column can leak the values you hid

Field-level permissions usually get enforced in the serializer. HR can see the salary column on the...