The nuxt-auto-crud engine enforces strict security boundaries by automatically filtering fields during CRUD operations.

🛡️ Protected Fields (Write-Only)

Protected fields are system-managed and cannot be updated via the generic CRUD endpoints. The engine automatically strips these from incoming payloads.

Default Protected Fields:

• Primary Keys: id
• Timestamps: createdAt, updatedAt, deletedAt, created_at, updated_at, deleted_at
• Audit Trails: createdBy, updatedBy, deletedBy, created_by, updated_by, deleted_by

🔒 Hidden Fields (Read-Prevention)

Hidden fields are stripped from all API responses (both GET list and GET single) to prevent sensitive data leakage.

Default Hidden Fields:

• Authentication: password, resetToken, githubId, googleId (and snake_case variants)
• Security: secret, token
• System Leakage: deletedAt, createdBy, updatedBy, etc.

🛠 Customization

Custom field sets can be defined per-model within the modelMapper.ts utility using customUpdatableFields and customHiddenFields.