How about using `_.omit` to clean it up further?

```js
var protectedAttributes = ['password', 'created_by', 'updated_by'];

return dataProvider.User.read(args).then(function(result) {
    return _.omit(result, protectedAttributes);
});
```