---
title: "Secret Serialization Review"
type: skill
id: "sentry-skills/security-checks/secret-serialization"
category: "Security"
publisher: "Sentry"
license: "Apache-2.0"
source: "https://github.com/getsentry/skills/tree/0c464f4"
canonical: "https://labs.pho.chat/en/skills/sentry-skills/security-checks/secret-serialization"
open_in_pho: "https://pho.chat/customize?item=sentry-skills%2Fsecurity-checks%2Fsecret-serialization&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library"
---

# Secret Serialization Review

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

Source: Sentry (Apache 2.0), copied at a pinned commit. Free to use. Part of the Phở Skills library (https://labs.pho.chat/en/skills).
Skill set: Sentry security checks (https://labs.pho.chat/en/skills/sentry-skills/security-checks.md).

## What it covers
- Boundary
- References
- Credential Fields
- Explicit Exclusion
- Investigation Process
- What To Report
- Severity
- What Not To Report
- Fix Guidance
- Finding Format

## Other skills in this set
- [GitHub Actions Security Review](https://labs.pho.chat/en/skills/sentry-skills/security-checks/gha-security-review.md): GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security…

## Use it
- In Phở: open https://pho.chat/customize?item=sentry-skills%2Fsecurity-checks%2Fsecret-serialization&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library and press Try, or add it so Phở loads it whenever a request matches. Phở works with your own API key (OpenAI, Anthropic, Google and others).
- Full instructions (original SKILL.md, unchanged): https://labs.pho.chat/skills/raw/sentry-skills/security-checks/skills/secret-serialization/SKILL.md
- Original files: https://github.com/getsentry/skills/tree/0c464f4 (Apache 2.0).
- Full machine-readable index: https://labs.pho.chat/skills.json