```suggestion strapi.sanitizers.add('content-api.output', sanitizers.defaultSanitizeOutput);```

You're exporting sanitize from utils; why not require it from there?

Same as above but with `content-api.output`

If we apply what's been said above, you could refactor this piece of code like that, what do you think? ```suggestion strapi.sanitizers .get('content-api.input') .forEach(sanitizer => transforms.push(sanitizer(schema))); ```

Maybe we could add a default value (empty array) here?

I would init this object to `{}` & delegate the creation of the `content-api` key to a loader ([similar to what we have for the admin](https://github.com/strapi/strapi/blob/master/packages/core/strapi/lib/core/loaders/admin.js)). What do you think?

Could you return `this` here? (to add chaining capability)

What do you think of adding a way to register new sanitizers? Something/A method to add a new key somewhere in the sanitizers object? IMO, it could be useful for plugin creators, etc... Smth like ```js set(path, value = []) { _.set(sanitizers, path, value); return this; } ```

Users-Permissions should be treated as a plugin and thus shouldn't be coupled with the Strapi core