My API Was Returning Every User's Password Hash. I Didn't Notice for Weeks.

Why a FastAPI endpoint happily sends back fields you never meant to expose, and the one line that filters them out.