Pattern for not accidently returning too much in the payload of a mutation?

[wondering639]

Imagine a mutation createUser with the input/fields

• username
• password

Obviously, in the payload of the mutation one doesn't want to return sensible informations like the password, but only e.g. the id of the new user and the username itself.

Is there any best practice on how to prevent returning sensible informations, e.g. doing accidently something like return user (where user is a object with Username, Password, Id properties) ?

[PascalSenn]

you would most always return a payload.
checkout https://chillicream.com/docs/hotchocolate/defining-a-schema/mutations/#conventions

I guess you should ignore the password field anyway on the user.