domains / families / security / secret-serialization

secret-serialization

separate

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

When to use

• check for secret serialization
• credential in repr
• repr=False audit
• secret in spans
• token in logs
• credential field in dataclass
• credential field in model
• credential field in config object

When not to use

• direct leaks interpolating a token into a log message
• hardcoded secret literals
• committed .env files

Skill page

Source