NestJS · DTOs · Mid-Level · Scenario
Scenario: client sends extra fields that overwrite isAdmin.
Short Interview Answer
Mass assignment — whitelist DTOs and never bind directly to entities with privileged fields.
Detailed Explanation
forbidNonWhitelisted helps. Separate admin-only DTOs/routes.