not expose user password by api
use husky