codejump
MediumJavaScriptTypeScript

Password Hash Leak — Strip Sensitive Fields Before Sending

JavaScriptSecuritySensitive Data Exposure

An API endpoint returns "the current user's profile" by sending back the full database record.

The bug: the database record includes passwordHash — a field that should never leave the server.

Your task: fix solve(user) so the returned object has every field from user except passwordHash.

Sample tests

Test #1Works for any role value, always strips the hash
Input: [{"id":"u4","role":"moderator","email":"carol@example.com","passwordHash":"$2b$10$qwerty12"}]
Output: {"id":"u4","role":"moderator","email":"carol@example.com"}
Test #2passwordHash stripped from customer record
Input: [{"id":"u1","role":"customer","email":"alice@example.com","passwordHash":"$2b$10$abcdefgh"}]
Output: {"id":"u1","role":"customer","email":"alice@example.com"}
Test #3passwordHash stripped from admin record too
Input: [{"id":"u2","role":"admin","email":"admin@example.com","passwordHash":"$2b$10$zzzzzzzz"}]
Output: {"id":"u2","role":"admin","email":"admin@example.com"}
← All challenges