Missing $fillable declaration permits unintended field mass-assignment in AdonisJS Lucid APIs

AdonisJS Lucid models declare mass-assignable fields through an explicit $fillable array; when this property is absent, all public attributes are writable via API payloads. This default, shifted to opt-in status in AdonisJS 5.x, means that models without a defined $fillable expose every column to potential modification through resourceful routes. When route guards or authentication middleware are not uniformly applied, unauthenticated requests may interact with these fields, particularly when combined with the framework's default CORS policy that allows all origins. The resulting overlap of implicit assignability, missing access controls, and permissive cross-origin settings creates a surface area for accidental public exposure that model definitions alone do not resolve.

• Does omitting $fillable on a Lucid model ensure that all attributes are mass-assignable across every API route in AdonisJS 5.x?
• Can per-route authentication middleware fully mitigate the risk when $fillable is not explicitly declared?
• What CORS origin restrictions are necessary to align with $fillable boundaries and prevent unintended field exposure?