diff --git a/goutils b/goutils
index c81cc802..826cb90a 160000
--- a/goutils
+++ b/goutils
@@ -1 +1 @@
-Subproject commit c81cc802441b9273c4ed706b4cf793eebd36cffd
+Subproject commit 826cb90a60959d32a3cad51062dd9688eb21744e
diff --git a/internal/autocert/config.go b/internal/autocert/config.go
index cad88d37..2d9f0a42 100644
--- a/internal/autocert/config.go
+++ b/internal/autocert/config.go
@@ -16,16 +16,17 @@ import (
 	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/internal/common"
 	gperr "github.com/yusing/goutils/errs"
+	strutils "github.com/yusing/goutils/strings"
 )
 
 type Config struct {
-	Email       string         `json:"email,omitempty"`
-	Domains     []string       `json:"domains,omitempty"`
-	CertPath    string         `json:"cert_path,omitempty"`
-	KeyPath     string         `json:"key_path,omitempty"`
-	ACMEKeyPath string         `json:"acme_key_path,omitempty"`
-	Provider    string         `json:"provider,omitempty"`
-	Options     map[string]any `json:"options,omitempty"`
+	Email       string                       `json:"email,omitempty"`
+	Domains     []string                     `json:"domains,omitempty"`
+	CertPath    string                       `json:"cert_path,omitempty"`
+	KeyPath     string                       `json:"key_path,omitempty"`
+	ACMEKeyPath string                       `json:"acme_key_path,omitempty"`
+	Provider    string                       `json:"provider,omitempty"`
+	Options     map[string]strutils.Redacted `json:"options,omitempty"`
 
 	Resolvers []string `json:"resolvers,omitempty"`
 
diff --git a/internal/autocert/providers.go b/internal/autocert/providers.go
index 54da5163..79895ba8 100644
--- a/internal/autocert/providers.go
+++ b/internal/autocert/providers.go
@@ -4,9 +4,10 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/yusing/godoxy/internal/serialization"
 	gperr "github.com/yusing/goutils/errs"
+	strutils "github.com/yusing/goutils/strings"
 )
 
-type Generator func(map[string]any) (challenge.Provider, gperr.Error)
+type Generator func(map[string]strutils.Redacted) (challenge.Provider, gperr.Error)
 
 var Providers = make(map[string]Generator)
 
@@ -14,10 +15,10 @@ func DNSProvider[CT any, PT challenge.Provider](
 	defaultCfg func() *CT,
 	newProvider func(*CT) (PT, error),
 ) Generator {
-	return func(opt map[string]any) (challenge.Provider, gperr.Error) {
+	return func(opt map[string]strutils.Redacted) (challenge.Provider, gperr.Error) {
 		cfg := defaultCfg()
 		if len(opt) > 0 {
-			err := serialization.MapUnmarshalValidate(opt, &cfg)
+			err := serialization.MapUnmarshalValidate(serialization.ToSerializedObject(opt), &cfg)
 			if err != nil {
 				return nil, err
 			}
diff --git a/internal/maxmind/maxmind.go b/internal/maxmind/maxmind.go
index e6ceb8fb..a487cd83 100644
--- a/internal/maxmind/maxmind.go
+++ b/internal/maxmind/maxmind.go
@@ -178,7 +178,7 @@ func (cfg *MaxMind) doReq(method string) (*http.Response, error) {
 	if err != nil {
 		return nil, err
 	}
-	req.SetBasicAuth(cfg.AccountID, cfg.LicenseKey)
+	req.SetBasicAuth(cfg.AccountID, cfg.LicenseKey.String())
 	resp, err := doReq(req)
 	if err != nil {
 		return nil, err
diff --git a/internal/maxmind/types/config.go b/internal/maxmind/types/config.go
index 4fa21987..16003029 100644
--- a/internal/maxmind/types/config.go
+++ b/internal/maxmind/types/config.go
@@ -4,14 +4,15 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	gperr "github.com/yusing/goutils/errs"
+	strutils "github.com/yusing/goutils/strings"
 )
 
 type (
 	DatabaseType string
 	Config       struct {
-		AccountID  string       `json:"account_id" validate:"required"`
-		LicenseKey string       `json:"license_key" validate:"required"`
-		Database   DatabaseType `json:"database" validate:"omitempty,oneof=geolite geoip2"`
+		AccountID  string            `json:"account_id" validate:"required"`
+		LicenseKey strutils.Redacted `json:"license_key" validate:"required"`
+		Database   DatabaseType      `json:"database" validate:"omitempty,oneof=geolite geoip2"`
 	}
 )
 
diff --git a/internal/proxmox/config.go b/internal/proxmox/config.go
index b0feba2d..4417c9f9 100644
--- a/internal/proxmox/config.go
+++ b/internal/proxmox/config.go
@@ -11,13 +11,14 @@ import (
 	"github.com/luthermonson/go-proxmox"
 	"github.com/yusing/godoxy/internal/net/gphttp"
 	gperr "github.com/yusing/goutils/errs"
+	strutils "github.com/yusing/goutils/strings"
 )
 
 type Config struct {
 	URL string `json:"url" validate:"required,url"`
 
-	TokenID string `json:"token_id" validate:"required"`
-	Secret  string `json:"secret" validate:"required"`
+	TokenID string            `json:"token_id" validate:"required"`
+	Secret  strutils.Redacted `json:"secret" validate:"required"`
 
 	NoTLSVerify bool `json:"no_tls_verify" yaml:"no_tls_verify,omitempty"`
 
@@ -48,7 +49,7 @@ func (c *Config) Init() gperr.Error {
 	}
 
 	opts := []proxmox.Option{
-		proxmox.WithAPIToken(c.TokenID, c.Secret),
+		proxmox.WithAPIToken(c.TokenID, c.Secret.String()),
 		proxmox.WithHTTPClient(&http.Client{
 			Transport: tr,
 		}),
diff --git a/internal/serialization/serialization.go b/internal/serialization/serialization.go
index 4b1835f6..26287a89 100644
--- a/internal/serialization/serialization.go
+++ b/internal/serialization/serialization.go
@@ -21,6 +21,22 @@ import (
 
 type SerializedObject = map[string]any
 
+// ToSerializedObject converts a map[string]VT to a SerializedObject.
+func ToSerializedObject[VT any](m map[string]VT) SerializedObject {
+	so := make(SerializedObject, len(m))
+	for k, v := range m {
+		so[k] = v
+	}
+	return so
+}
+
+func init() {
+	strutils.SetJSONMarshaler(sonic.Marshal)
+	strutils.SetJSONUnmarshaler(sonic.Unmarshal)
+	strutils.SetYAMLMarshaler(yaml.Marshal)
+	strutils.SetYAMLUnmarshaler(yaml.Unmarshal)
+}
+
 type MapUnmarshaller interface {
 	UnmarshalMap(m map[string]any) gperr.Error
 }