final class X
{
private string $secretValue;

public function __construct(string $secretValue)
{
    $this->secretValue = $secretValue;
}

/**
 * @return array<mixed>
 */
public function __debugInfo(): array
{
    $properties = get_object_vars($this);
    $properties['secretValue'] = empty($properties['secretValue']) ? '' : '********';
    return $properties;
}

}

class XTest extends TestCase
{
public function testVarDumpDoesntRevealSecret()
{
$secretValue = 'supersecret';
$sut = new X(
$secretValue,
);

    ob_start();
    var_dump($sut);
    $output = ob_get_clean();

    self::assertStringNotContainsString($secretValue, $output);
    self::assertStringContainsString('********', $output);
}

}