Using the transient modifier, managed to hide User.password from any serializer attempting to expose it. This means it is hidden without pre-configuring the serializer. This also means that db4o will not store the password by default thus I added a special db4o configuration in DataStore enabling storage of transient fields. I fixed the unit test for UserManager.makeEntity so that it manually inserts the password field into the user string because User.toJSON no longer includes the password field.