I'm really glad that ModelSerializer classes now require either fields or exclude. IMHO not requiring that before was one of the biggest weaknesses of the proje

I'm really glad that ModelSerializer classes now require either fields or exclude. IMHO not requiring that before was one of the biggest weaknesses of the project, since it could easily lead to data being unintentionally exposed. I know that's maybe not the most exciting change, but I think it's important that it be very obvious what the code does even if a person isn't an expert in a given technology, especially when there are privacy/security implications.