fix(serializer): mask pydantic secret values

[hassiebp]

What does this PR do?

Prevents Pydantic SecretStr and SecretBytes wrappers from being reflected into serialized trace data. The serializer now returns a stable <secret> placeholder before generic object handling.

Adds focused coverage for bare secrets and secrets nested in Pydantic models.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

LANGFUSE_PUBLIC_KEY=<synthetic> LANGFUSE_SECRET_KEY=<synthetic> LANGFUSE_BASE_URL=http://127.0.0.1:9999 uv run --frozen pytest -n auto --dist worksteal tests/unit
# 691 passed, 2 skipped, 34 warnings

uv run --frozen ruff check .
# All checks passed!

uv run --frozen ruff format --check langfuse/_utils/serializer.py tests/unit/test_serializer.py
# 2 files already formatted

uv run --frozen mypy langfuse --no-error-summary
# passed

A direct trace-attribute serialization check confirmed neither synthetic raw value remains in the serialized input and both values serialize as <secret>.

The repository-wide format check was not used as evidence because unrelated tests/unit/test_media.py is already reported as needing reformatting; both changed files pass the format check.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes.
• Docs, examples, and .env.template do not require updates.
• I did not hand-edit generated files.
• I did not commit secrets or credentials.

  

Confidence Score: 3/5

This PR is not safe to merge because it adds assertions for secret masking without implementing that masking, leaving the disclosure path unresolved.

Summary

This PR adds regression tests intended to ensure Pydantic SecretStr and SecretBytes values are masked during event serialization, both as bare values and within Pydantic models. However, it does not add the serializer behavior required by those assertions.

• Adds parameterized coverage for bare Pydantic secret wrappers.
• Adds coverage for secret fields in a Pydantic model.
• Leaves the generic serializer paths capable of traversing the wrappers' underlying secret values.

_{Reviews (1) · Last reviewed commit: "test(serializer): cover pydantic secret ..."}

[github-actions]

@claude review

[claude]

Claude Code Review

No review was started: this request came from a bot account. Manual reviews can only be requested by someone with write access to this repository. Ask a maintainer to comment @claude review, or have your automation post the comment from a user account with write access.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T13:35:37.483284Z	5ad676f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ad676f92a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".