> This might be the fault of opt-out serialization library (by default it serializes the hole object and you need to manually opt-out fields from it). So a programmer adds a field, forgets to add opt-out annotation and voilà.

In a previous job, on my first audit of the code, I spotted such vulnerabilities pretty much everywhere.

Developers simply need to stop using these libraries.