Which fields actually get stored?

Edit the JSON body POST /api/users would receive. Toggle between this week's two real create_user() implementations and watch which fields survive into the stored user.

Request body (JSON)

Server implementation vulnerable_api.py — user.update(body) solution_api.py — allow-list

Which fields actually get stored?

Stored user object