Some properties in your data model should never be settable by user input under any circumstances. Identify and protect them explicitly:
• Authorization flags: isAdmin, role, permissions, accessLevel
• Platform-controlled status: verified, blocked, suspended, approved, flagged
• Financial data: balance, price, discount, credits — anything that affects money
• Internal tokens: resetToken, verificationToken, apiSecret
• Computed values: createdAt, updatedAt, score, rank — values the server calculates
These fields should be marked as read_only in your serializer, decorated with @JsonIgnore on input, or simply absent from every input DTO.
Treat every property as server-side only by default. The developer must actively decide to make a field user-settable — not the other way around. When in doubt: don't accept it from the client.
Protecting write access doesn't protect read access. If your API returns these fields in responses (even as read-only), you still have an excessive data exposure problem. Apply MIT 05 and 06 as well.
Ask your engineering team whether the data structure they accept from users is the same object they store in the database. If it is, that’s a mass assignment risk that should be reviewed.