A user needs to expose only a given list of fields to its users. Elasticsearch has a `_source_excludes` query param to exclude some fields returned in the search response. [Doc ref](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-get.html#docs-get-api-query-params)
