Would it be a security issue adding hashedPassword to getUserAttributes

[rwieruch]

	getUserAttributes: (attributes) => {
		return {
			hashedPassword: attributes.hashed_password,
			email: attributes.email
		};
	}

[pilcrowonpaper]

I would avoid doing that. You can leak user password hashes if you have an endpoint that returns the entire user object (worse if it's public)

[rwieruch]

That's what I thought. Thanks!