Secret Serialization
Finds secrets, tokens, passwords, and API keys that can leak through generated...
Install
npx skills add getsentry/skills --skill secret-serialization -g -a claude-code -y- Repository
- getsentry/skills1.1k
- Category
- Engineering
- Updated
- 9d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,448 tokens
- Runs scripts
- No, instructions only
What it does
Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.
Secret Serialization Review
Find credentials that can leak because a type serializes itself and something upstream serializes whole objects.
A leak usually needs two changes that each look safe alone:
- Holder: a credential is stored as a field on a type with generated
repr,str,asdict,model_dump,toJSON, or property enumeration. - Sink: logging, tracing, error reporting, caching, or a response serializes whole objects or every kwarg (
str(value),span.set_data(key, obj),logger.info("%s", obj),JSON.stringify(args)).
The two sides are often written months apart by different authors. Report either side on its own. Always search the existing tree for the other side, because it is frequently already on the default branch and absent from the diff.
Boundary
- This skill covers indirect leaks through generated serialization and wholesale sinks.
- Direct leaks, such as interpolating a token into a log message, belong to
security-review. Report them here only when they come from a changed wholesale sink. - Hardcoded secret literals and committed
.envfiles are out of scope.
References
| Reference | Read When |
|---|---|
references/python.md | Reviewing Python dataclasses, attrs, pydantic, NamedTuple, msgspec, logging, Sentry SDK, or OpenTelemetry code |
references/javascript-typescript.md | Reviewing JavaScript or TypeScript classes, config objects, JSON.stringify, util.inspect, pino or winston, or Sentry and OpenTelemetry spans |
Credential Fields
Treat a field as credential-bearing when its name, type, or source says so:
