title: Passing Objects to EJS in Node.js
body: <p>Apologies if this is a silly question, I have been passing JSON db collection objects to my EJS template code in a Node.js POST request with <code>res.render("login", {var: object});</code> and am only using some of the contents of each (escaped) for my templates.</p>
  
  <p>Just to confirm, is it only the final rendered contents of the template that is returned to the client or does the entire object get passed back?</p>
  
  <p><strong><em>example:</em></strong></p>
  
  <p><strong><em>App.js</em></strong></p>
  
  <pre><code>Company.find({companyCode: "12345"}, function(err, foundCompany){
  if(err){ console.log(err); }
  
  res.render('/login', {foundCompany: foundCompany});
  </code></pre>
  
  <p><strong><em>Login.ejs</em></strong></p>
  
  <pre><code>&lt;p&gt; The Company is: &lt;%= foundCompany.name %&gt; &lt;/p&gt;
  </code></pre>
  
  <p>From a security point of view, if "foundCompany" contained alot more information I did not particularly want the user finding a way to access, is this all sent to the client on render or is it only the escaped values used which have been manipulated by the back end template engine?</p>