Leak a column you never exposed

import java.lang.reflect.*;
import java.util.*;

/**
 * Warm-up: publish a password hash without meaning to.
 *
 * No Jackson and no Hibernate. A serialiser is, for this purpose, a thing that
 * reflects over fields and emits all of them — which is the only property that
 * matters here.
 */
public class Starter {

    public static void main(String[] args) throws Exception {

        // TODO 1: write serialise(Object) using reflection over
        // getDeclaredFields(). Emit every field as a JSON key. Recurse into
        // objects and collections, and pass a depth so you can stop.
        //
        // Note: getDeclaredFields() order is unspecified by the JLS. It is
        // stable in practice for a given class file, and worth knowing you are
        // relying on that.

        // TODO 2: write a User entity with id, email and displayName. Serialise
        // it. This is your API response.

        // TODO 3: now add passwordHash and internalNotes to the entity, as a
        // migration would. Do not touch the serialising code. Print the JSON
        // again and compare.
        //
        // Write one sentence about which review would have caught that.

        // TODO 4: define a record UserResponse(long id, String displayName),
        // populate it from the entity, and serialise that instead. Add another
        // field to the entity and confirm the response does not change.

        // TODO 5: build a bidirectional pair — Author has books, Book has an
        // author — and serialise the author. You will need a depth limit.
        // Say what Jackson does instead of stopping, and why the mapping is
        // still not the thing that is wrong.

        // TODO 6: give the entity a lazy field: a wrapper holding a Supplier
        // that increments a counter the first time it is read. Serialise the
        // entity and print the counter before and after.
        //
        // Then say where that query happens relative to the transaction, and
        // which of your timers would have seen it.

        // TODO 7: finally, the direction people forget. If a controller
        // accepted this entity as a request body, list the fields a caller
        // could set. Say what setting `id` would do to a save().
    }
}