I was doing things manually to, even security! You don't really need DTOs because you can use projections and set a default projection to be used when that ent

I was doing things manually to, even security! You don't really need DTOs because you can use projections and set a default projection to be used when that entity type is returned in a collection. Any entity fields that should never be exposed can be annotated with @JsonIgnore. And then if you need endpoints that aren't CRUD, you can build those the usual way.