When you set a field option like { select: false } in a Mongoose schema, it only affects queries such as .find(), .findOne(), .findById(), .findOneAndUpdate(), etc.

It does not affect .create() or .save(), because those operations don’t query the database — they just create and return the new document object.

So, if you want to exclude a field like password when returning a newly created user, you’ll need to explicitly call .select('-password') on the query after creating or fetching it.

According to the Mongoose docs for SchemaTypeOptions.select

Whether to include or exclude this path by default when loading documents using find(), findOne(), etc.