No validation on updates, plain-text passwords, returning passwordHash, no indexes on hot queries, embedding unbounded arrays, N+1 queries, not handling duplicate key errors, no pagination, no .lean() for read-only queries, sync calls, mixing validation with logic, and no timestamps.
Mark the field with select: false in the schema. It is excluded from find queries by default. Use .select('+passwordHash') only when needed (e.g., for login).
Catch the error in your handler. Check err.code === 11000 (MongoDB duplicate key error). Return 409 with a clear message instead of letting the error handler send a 500.
Mongoose runs validation on .save() and .create() but not on findByIdAndUpdate or updateOne by default. Pass { runValidators: true, new: true } on every update to enforce validation.
Browse all our FAQs or reach out to our support team
Your learning library
Find your next course. Build something great.
