privacy-by-design-rails

No malicious behavior or obfuscated payload is present. The code generally applies strong-parameter and serializer allowlists, but DataExportable is unsafe by default because undeclared models export all columns. Consider raising an error or returning an empty list when no explicit exportable fields are configured, validating fields as attributes, and reviewing whether session.id should be returned as a client token.