Question

An AI assistant wrote this Go struct and handler to expose a user record over JSON. After release, the frontend reports that `email` and `role` are always missing, and a security reviewer flags a separate issue.

1type User struct {2    ID        int643    email     string4    Role      string `json:"-"`5    Password  string `json:"password"`6    CreatedAt time.Time `json:"created_at"`7}8 9func handler(w http.ResponseWriter, u User) {10    json.NewEncoder(w).Encode(u)11}

What's wrong with the serialization, and what's the security problem?