I am using Profile:Edit to display a form which allows the user to update and edit their profile. However I have some custom fields which I want to protect from being changed. I am not displaying these fields to the user, but if the user was to 'hack' the page by manually inserting an input text field into the page they are viewing (using the browsers inspector tool) then they can submit any field they like and profile edit will happily update the value (I have tested this).
How can I stop Profile:Edit from updating any field it receives via POST, and only update values I give it permission to update?
Let me know if you don't get what I mean.