DTO
A data transfer object defines the fields crossing an application boundary.
Use this when An endpoint exposes private fields or accepts writable fields the caller should not control.
without the term
“Our user API returns the password hash and internal flags, and someone could probably set isAdmin by adding it to the request. Can you control exactly what goes in and out?”
with the term · How do you ask a model for DTO?
Define input and output DTOs for this endpoint. Verify sensitive fields cannot be read or assigned through extra request properties.
What is DTO?
Separate types for what an endpoint accepts and returns. Only fields you listed cross the boundary, so internal fields stay hidden and callers can't set fields like isAdmin.
Why does DTO matter when vibe coding?
Returning the ORM object can leak fields added by a later migration.
How do you do DTO?
Define explicit input and output contracts and map only the permitted fields.
What goes wrong with DTO?
Inheriting the full persistence model and calling it a restricted DTO.