Function strip_internal_keys 

pub fn strip_internal_keys(row: &mut ParseMap)

Remove every _-prefixed key from a row before it becomes a response.

Upstream does the same unconditionally in filterSensitiveData (DatabaseController.js:288-292), for every class rather than just _User. It is what keeps _rperm, _wperm, _hashed_password and anything else internal off the wire even when an earlier step forgot.

Applied at the response boundary rather than deep in the pipeline, so there is exactly one place to audit and no path that reaches a client without passing through it.