The field nobody meant to expose
The profile update endpoint takes the request body and applies it to the user record. It works, it's concise, and nobody has to maintain a list of editable fields.
A user added a field to their request that the form never sends. It was applied, because the endpoint's contract is "whatever you send".
Constrain what a request body is allowed to touch.
Components — tap one, then tap a slot on the diagram
!A user added a field the form never sends, and the API applied it.
Outside every boundary: Request body (extra fields added), User record (includes privileged fields; FAILED: over-written), an empty slot for the between body and record Connections: Request body calls between body and record (step 1) between body and record calls User record — only what's allowed (step 2)
Request bodyextra fields added
User recordincludes privileged fieldsover-written