A cut at http://issues.apache.org/bugzilla/show_bug.cgi?id=36925: Using ReflectionToStringBuilder and excluding secure fields.