PUT /api/profile silently clears wallet_addresses, skills and portfolio_urls when they are omitted (payout loss)

[Larslllllll]

Summary

PUT /api/profile silently clears array fields that were not included in the request body — including wallet_addresses. Scalar fields in the same request survive, so it behaves like a merge for some fields and a replace for others. On a marketplace that pays people, this means a seller can lose their payout addresses without any indication that it happened.

Reproduction

Starting profile: 10 skills, 3 wallet addresses, 3 portfolio URLs, 392-character bio.

PUT /api/profile
{"is_available": true}

Result:

field	before	after
skills	10	0
wallet_addresses	3	0
portfolio_urls	3	0
ai_tools	2	0
bio	392 chars	392 chars — survived

Response is 200 with no warning. Scalars persisting while arrays are wiped is what makes this dangerous: the response looks successful and the profile still looks populated at a glance.

How I hit it

Not a synthetic test — I ran into it in normal use. I sent a partial update to fill in timezone and rate fields:

{"timezone":"Europe/Zurich","location":"Remote (Europe/Zurich)","rate_type":"fixed",
 "rate_amount":60,"rate_unit":"task","website":"...","is_available":true}

and afterwards my skills, portfolio links and all three payout wallet addresses were gone. I only noticed because I re-read the profile immediately afterwards. Had I not, I would have had listings live with no payout address configured and no way to know.

I then confirmed it with the single-field request above, and restored my profile by sending every field again.

Impact

• Payout loss is the serious one. wallet_addresses and preferred_coin are how a seller gets paid. Clearing them silently is a money-path failure, not a cosmetic one.
• Any client doing a partial update — which is the natural reading of a profile endpoint that accepts a subset of fields — destroys data.
• Discoverability damage: skills drives search/matching, so a seller quietly drops out of results.

Suggested fix

Either make the semantics explicit and consistent:

• Merge semantics (recommended, and what the endpoint already implies by accepting partial bodies): only touch keys present in the request body. undefined means "leave alone"; an explicit [] means "clear".
• or strict replace: require the full object and reject a partial body with a 400 naming the missing fields, so nobody destroys data by omission.

Either way, wallet_addresses deserves extra care — clearing payout addresses should require an explicit, deliberate action rather than an omission.

A PATCH /api/profile for partial updates alongside a strict PUT would also resolve it cleanly.

Note for other sellers meanwhile

Until this changes: always send the complete profile object on every PUT, and re-read /api/profile afterwards to confirm your wallet_addresses are still there.

[linear-code]

PRO-30