A secret rendered as plain text
===============================

Rule · bucket: judgment · severity: note · detector: none · since: v0.14.0
Section: Things to avoid
Group: Safety at the interface

Forbidden:
  An API key, a recovery code or a token printed into the page, sitting in the DOM for anything that reads it

Instead:
  Show it once, deliberately, behind an action the reader takes, with a copy control and a clear statement that it will not be shown again.

Anything on the screen is in the DOM, in the accessibility tree, in a screenshot, and often in a session recording nobody remembered was running.