Sorting by a hidden column can leak the values you hid

Field-level permissions usually get enforced in the serializer. HR can see the salary column on the employee list and managers can't, so the API drops salary from the response for managers. The list endpoint still accepts ?sort=salary and ?salary_gte=120000, though, because the query builder takes any column the model has.

So a manager sorts their team by salary. The salary column is missing from the response, yet the rows come back in pay order. Add the salary_gte filter and they can narrow down one person's pay in a handful of requests, binary search style. Search over hidden fields and group-by counts leak the same way.

Build the allowed sort and filter fields from the same field permissions the serializer uses, per caller, and reject anything outside that set. If you have saved views or a report builder, check the stored sort and filter keys when the view runs, since a view an HR user saved can be opened by someone else.

Quick test: as a user who can't see a field, request the list sorted by that field ascending, then descending. If the order flips, the sort is leaking it.