Skip to content

Phở Founder Lifetime: $59 once, 1 year of Phở AI included. Limited seats. See the offer

Security · Skill

Secret Serialization Review

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

Open in Phở

What the skill covers

The sections of its instructions, in order.

  1. 01 Boundary
  2. 02 References
  3. 03 Credential Fields
  4. 04 Explicit Exclusion
  5. 05 Investigation Process
  6. 06 What To Report
  7. 07 Severity
  8. 08 What Not To Report
  9. 09 Fix Guidance
  10. 10 Finding Format

Reference files

4 files Phở can open while it uses the skill.

  • SOURCES.md
  • SPEC.md
  • references/javascript-typescript.md
  • references/python.md

More in Sentry security checks

  • GitHub Actions Security Review

    GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security"…

Similar security skills

Frequently asked questions

What does Secret Serialization Review do?

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

Is Secret Serialization Review free to use?

Yes. Secret Serialization Review is published by Sentry under the Apache 2.0 licence, and you can use it with a free Phở account.

How do I use Secret Serialization Review in Phở?

Press Open in Phở, then Try to apply it to your next message, or add the Sentry security checks set so Phở loads it whenever a request matches.

Does Secret Serialization Review need other tools?

No. It works in a normal Phở chat with what you type or upload.

Copied unchanged from getsentry/skills at commit 0c464f4 and credited to Sentry, who is not affiliated with Phở. The full instructions and licence text ship with the skill inside Phở.