I have this situation where I just happened to die and dump dd($event) an event where I injected the current $user.
I notice that, in the attributes part, I do see the password is shown in that collection. I have indeed added the password column inside the $hidden array.
Why is this happening. Is there something else I should do to keep it hidden?
I have tested by dd($user) the $user only.
via Pathros
