The lack of an ``API_WHITELIST`` here feels wrong. As I understand it, it will inherit the whitelist from the ProcessedCrash model, and thus will not be allowed to return all the private fields, as they are not in the previous whitelist. Does that not go against the purpose of this model? 

Or, if we don't want to expose unredacted crashes in the API, I suppose there should be something like ``API_WHITELIST = None`` here.