Automatic data exclusion in aggregations with Mongoose - mongodb

Question

In my Mongoose models, I've set sensitive data to select: false so it isn't returned with queries by default:
const userSchema = new mongoose.Schema<User, UserModelType, {}, UserQueryHelpers>({
username: {...},
email: { type: String, required: true, unique: true, validate: [validator.isEmail, 'invalid email'], select: false },
password: { type: String, required: true, select: false },
profilePicUrl: { type: String },
emailVerified: { type: Boolean, required: true, default: false, select: false },
[...]
});
To my shock, I realized that this doesn't work in all scenarios. Namely lookup queries in aggregations don't respect select: false.
const result = await KarmaLogEntry.aggregate()
.match({
createdAt: { $gte: startOfCurrentMonth }
})
.group({
_id: "$user",
totalPoints: { $sum: "$points" }
})
.sort({ 'totalPoints': -1 })
.limit(10)
.lookup({
from: "users",
localField: "_id",
foreignField: "_id",
as: "user",
})
.unwind('$user')
.exec();
This returns all the sensitive fields!
I know that I can exclude fields with an additional $project stage:
.lookup({
from: "users",
localField: "_id",
foreignField: "_id",
as: "user",
pipeline: [
{
$project: {
username: '$username',
displayName: '$displayName',
profilePicUrl: '$profilePicUrl',
}
}
]
})
However, if I ever forget to add this for an endpoint, I will leak sensitive user data. Is there a way to apply select: false to all forms of MongoDB queries, including aggregation and lookups?