Agreed. They really should be separate. Suppose an API GET /users/:username call returns a "User" type. If returns the the same type as in your database, would

Agreed. They really should be separate. Suppose an API GET /users/:username call returns a "User" type. If returns the the same type as in your database, wouldn't you also get their password hash as well with that request? How do coupled frameworks deal with this?