#967

src/api/serializers/user.ts

@@ -78,6 +78,8 @@ export default (
 	// Remove private properties
 	delete _user.password;
 	delete _user.token;
+	delete _user.two_factor_temp_secret;
+	delete _user.two_factor_secret;
 	delete _user.username_lower;
 	if (_user.twitter) {
 		delete _user.twitter.access_token;
@@ -91,6 +93,10 @@ export default (
 		delete _user.client_settings;
 	}
 
+	if (!opts.detail) {
+		delete _user.two_factor_enabled;
+	}
+
 	_user.avatar_url = _user.avatar_id != null
 		? `${config.drive_url}/${_user.avatar_id}`
 		: `${config.drive_url}/default-avatar.jpg`;