Several endpoints return complete database rows instead of specific required fields, leading to the exposure of sensitive secrets. The channel delete endpoint returns the deleted integration row, which includes the platform access token and refresh token, allowing a third-party OAuth app to obtain social platform credentials. Additionally, the `GET /user/organizations` endpoint returns the organization row including the API key to all members, enabling users with lower roles to obtain the key intended for admins and call the public API on behalf of the organization. Access to these endpoints requires a valid session, API key, or OAuth token and is restricted to the caller's own organization.