Will It Vibe?response_model omitted on a route returning a raw database result
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
The route decorator has no response_model and the handler returns a value straight from a query call (.query(), .first(), .all(), .execute(), ...). Without response_model FastAPI serializes whatever attributes the ORM object or row carries, which can include password hashes or other internal-only fields. Heuristic: confirm the returned object is not already filtered before adding response_model.
Why it matters
Returning an ORM object or raw query row with no response_model means FastAPI serializes every attribute that object happens to carry, not just the fields the API is meant to expose. That silently includes anything the ORM model has: a password hash column, an internal status flag, a foreign key to another tenant's data, whatever the underlying table has that the endpoint's author never intended to publish.
How to fix it
Add response_model=YourModel to the route decorator, where YourModel is a Pydantic model listing exactly the fields that should be in the response. FastAPI will then filter the returned object down to just those fields (and validate their types) before sending it, regardless of what else the underlying ORM object carries.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo