Small addition: some data can be exposed via the api with population, so those cases need to be handled. The User.schema defines a transform method, for example, so that the password field is never exposed via the api.