@ngdoc error @name $parse:isecprv @fullName Referencing private Field in Expression @description Occurs when an Angular expression attempts to access a private field. Fields with names that begin or end with an underscore are considered private fields.  Angular expressions are not allowed to reference such fields on the scope chain.  This only applies to Angular expressions (e.g. {{ }} interpolation and calls to `$parse` with a string expression argument) – Javascript itself has no such notion. To resolve this error, use an alternate non-private field if available or make the field public (by removing any leading and trailing underscore characters from its name.) Example expression that would result in this error: ```html
{{user._private_field}}
``` Background: Though Angular expressions are written and controlled by the developer and are trusted, they do represent an attack surface due to the following two factors: - they typically deal with user input which is generally high risk - they often don't get the kind of attention and test coverage that JavaScript code would. If these expression were evaluated in a context with full trust, an attacker, though unable to change the expression itself, can feed it unexpected and dangerous input that could result in a security breach/exploit. As such, Angular expressions are evaluated in a limited context.  They do not have direct access to the global scope, Window, Document, the Function constructor or "private" properties (names beginning or ending with an underscore character) on the scope chain.  They should get their work done via public properties and methods exposed on the scope chain (keep in mind that this includes controllers as well as they are published on the scope via the "controller as" syntax.) As a best practise, only "publish" properties on the scopes and controllers that must be available to Angular expressions.  All other members should either be in closures or be "private" by giving them names with a leading or trailing underscore character.