Content API exposes private data - or am I being dumb?

I've enabled the content API and in my api.php I've set

  'resources' => [
        'collections' => false,
    ]

I then hit:

mydomain.com/collections/news_articles/entries?filter[news_categories:contains]=category-b

And all works, the problem is I'm seeing user data:

"updated_at": "2021-05-01T14:10:37.000000Z",
      "updated_by": {
        "id": "7ea8cf2e-0377-481a-bda2-4b63ec87a2f3",
        "name": "Robert Cooper",
        "email": "******", 
        "api_url": "http:\/\/*******\/api\/users\/7ea8cf2e-0377-481a-bda2-4b63ec87a2f3"
      },
      "uri": null,
      "url": "\/"

I'm new to Statamic so I'm confident I'm just doing something dumb. Help appreciated.