The Leaked Password
The user profile page loads correctly and shows the right information
The bug report
You get the whole project — a React front end, an Express API, and Mongoose models — opened in a browser editor. Reproduce the symptom by reading the code, change what’s wrong, and run the hidden tests to prove it.
What the fix must prove
- hides the password hash from the profile response
- hides the admin flag from the profile response
- still returns the public profile fields
- never loads the password hash without an explicit request
Related challenges
- The Missing Name — api contract bug, beginner
- The Ghost Update — async / race condition, intermediate
- The Silent Field — database / schema bug, beginner