Getting users will return sensitive information

[rootkie]

When user object is returned from query, it includes password hash. Consider a post hook in model or some sort of filtering.