Function default_protected_fields 

pub fn default_protected_fields() -> ProtectedFieldsConfig

The upstream default, {_User: {'*': ['email']}} (Options/Definitions.js:495-499).

Merged as a set union per entity key over the class’s own block (SchemaController.js:577-586), so it composes with a configured protectedFields rather than replacing it. A class that protects phone from * ends up protecting phone and email, which is what a parse-server node reading the same database would do.