Mongoose FindOne исключайте перриковое поле

//Return the User document without having password field
User.findOne({_id: userId}).select("-password")

//Incase wants to add excluded field
User.findOne({_id: userId}).select("+password")
Jaimin Patel