@Peppe_LG: At the same time, wouldn’t you agree that for the “rapid prototyping” use case, this is a true statement? While autopublish is a part of the the application, it doesn’t make sense to modify any other field because then you have to write a custom publish. And when you are outside of the “rapid prototyping” stage and writing a publish statement, would you rather publish just the username, profile, and services, or would you rather whitelist every field you need and then rewrite all of your code that accesses those fields?
You are correct in stating that the documentation says nothing about which fields to modify. Therefore, I modify my previous statement to be, “IMHO, the profile field is the only one you should modify for a meteor user”