send_only ignored on create

[sfcgeorge]

I have a policy specifying send_only. It works as expected on fetch, execute_remote returns only the specified attributes.

But on creating a new record, execute_remote returns the full record with all attributes - ignoring send_only.

Potential security issue depending what the other attributes are, and wastes data transfer.

[catmando]

good catch... point being that if you have some before_save hook that computes some field values that should not be seen by the client they will be exposed. Is that the only case that this could happen on?