This way, the password is passed inside the json for every user retrieved..
I thought of the alternative of writing a query selecting only the columns I need, and using DB::query()... However, this way, I would not be using the model, and I would have to type every single column, for every single model I want to do this to..
You can define a static property in your model called "$_to_array_exclude" which is an array of model properties you don't want to expose (so it acts like a filter).