diff --git a/models/user.go b/models/user.go
index dc6769e..d19833b 100644
--- a/models/user.go
+++ b/models/user.go
@@ -4,12 +4,15 @@ package models
 type User struct {
 	ID                 uint   `gorm:"column:id;primaryKey"`
 	Email              string `gorm:"column:email"`
-	Password           string `gorm:"column:password"`
+	Password           string `gorm:"column:password" json:"-"`
 	MustChangePassword bool   `gorm:"column:must_change_password"`
 }
 
 func (User) TableName() string { return "users" }
 
+// Hidden mirrors PHP User::$hidden for the columns this stub carries (D-08).
+func (User) Hidden() []string { return []string{"password"} }
+
 func init() {
 	Register(User{})
 }