A secret rendered as plain text
- Forbidden
- An API key, a recovery code or a token printed into the page, sitting in the DOM for anything that reads it
- Instead
- Show it once, deliberately, behind an action the reader takes, with a copy control and a clear statement that it will not be shown again.
What this rule looks like
Why this rule
Anything on the screen is in the DOM, in the accessibility tree, in a screenshot, and often in a session recording nobody remembered was running.
- Kind
- Rule
- Section
- Things to avoid
- Group
- Safety at the interface
- Bucket
- judgment
- Severity
- note
- Since
- v0.14.0