To prevent accidentally showing your users secure fields (i.e. password) by mistyping, you can secure fields with Model.hides in your Model definition file.
// Password will NEVER be shown as the output of an API response User.hides('password');