What are best practices for working with Serializable?

import java.io.Serializable;

public class User implements Serializable {
    private static final long serialVersionUID = 1L; // Best practice: Explicit serialization ID

    private String username;
    private String password; // Consider marking sensitive data as transient

    // Constructor, getters, and setters

    public User(String username, String password) {
        this.username = username;
        this.password = password;
    }

    public String getUsername() {
        return username;
    }

    public String getPassword() {
        return password;
    }
    
    // Best practice: Provide readObject() to handle custom deserialization
    private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject(); // Default deserialization
        // Additional checks or initialization can go here
    }
}
// Additional best practices could include 
// careful handling of versioning and filtering sensitive information