How would you prevent an API response from accidentally exposing fields added to an entity later?

Tests whether you default to explicit DTOs/response projections instead of serializing entities directly, since a new entity field otherwise gets exposed automatically the moment someone adds it, with no compile-time warning.