diff --git a/wafer/users/serializers.py b/wafer/users/serializers.py
index <HASH>..<HASH> 100644
--- a/wafer/users/serializers.py
+++ b/wafer/users/serializers.py
@@ -6,3 +6,6 @@ class UserSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = get_user_model()
+        # Arguably not useful to expose via the REST api without
+        # more thought.
+        exclude = ('password',)
Don't expose password via the api for now