fix: issue user's private fields such as password were returned

backend/routes/users/search.js

@@ -31,6 +31,7 @@ module.exports = function (sequelize) {
 
       const users = await User.findAll({
         where,
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
         limit: 7,
       });
       res.json(users);