[wp-trac] [WordPress Trac] #65303: API Key is exposed in browser autofill/autocomplete suggestion dropdown on integration setup form

[WordPress Trac]

#65303: API Key is exposed in browser autofill/autocomplete suggestion dropdown on
integration setup form
--------------------------------+-----------------------------
 Reporter:  modi2918            |      Owner:  (none)
     Type:  defect (bug)        |     Status:  new
 Priority:  normal              |  Milestone:  Awaiting Review
Component:  Security            |    Version:
 Severity:  normal              |   Keywords:
  Focuses:  ui, administration  |
--------------------------------+-----------------------------
 When entering an API key in the integration setup form (Anthropic
 provider), the API key value appears in the browser autocomplete/autofill
 suggestion dropdown in plain text. This can expose sensitive credentials
 to anyone with access to the browser session or screen.

 The API key field should behave like a secure password field and should
 not display previously entered values as suggestions.

 Steps to Reproduce:

 Open the AI integration settings page.
 Navigate to the Anthropic API key setup section.
 Click inside the “API KEY” input field.
 Browser displays previously entered API keys in autocomplete suggestions.

 Actual Result:
 Previously entered API keys are visible in browser suggestion/autocomplete
 dropdown.

 Expected Result:
 API keys should never appear in autocomplete suggestions or stored browser
 history.
 The field should:

 Use secure input masking (type="password")
 Disable autocomplete (autocomplete="off" or autocomplete="new-password")
 Prevent sensitive values from being exposed in browser suggestions

 Impact:

 Sensitive API credentials can be exposed visually
 Risk of credential leakage during screen sharing or shared device usage
 Security/privacy concern for users managing third-party integrations

 Suggested Fix:

 Change API key input field to password type
 Disable browser autocomplete/autofill for the field
 Optionally add a show/hide toggle for usability
 Ensure keys are not cached in frontend storage unnecessarily

 Environment:

 Browser: Chrome (observed)
 Module: AI Integration Settings
 Provider: Anthropic

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65303>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform