From 273fbedffd7f7b438dc9c1476650c64b0e58f986 Mon Sep 17 00:00:00 2001
From: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Date: Thu, 5 Nov 2026 11:14:35 -0800
Subject: [PATCH] fix(web): screen readers no longer read out a secret typed
 into the request card

The card masked a text input with -webkit-text-security, which only hides
the glyphs: Chromium still exposes the plaintext as the field's accessible
value. Use a password input like the other non-login secret fields; the
autocomplete and password-manager opt-outs stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/chat/SecretRequestCard.tsx | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/components/chat/SecretRequestCard.tsx b/apps/web/src/components/chat/SecretRequestCard.tsx
index 2ec2923b88bbd..bb705f7b1cc9a 100644
--- a/apps/web/src/components/chat/SecretRequestCard.tsx
+++ b/apps/web/src/components/chat/SecretRequestCard.tsx
@@ -124,9 +124,8 @@ function PendingSecretRequestForm(props: {
         <div className="min-w-0 flex-1">
           <Input
             id={inputId}
-            // Password fields prompt to save credentials; this secret is not a login.
-            type="text"
-            className="[-webkit-text-security:disc]"
+            // A CSS-masked text field still exposes its value to screen readers.
+            type="password"
             autoComplete="off"
             autoCorrect="off"
             autoCapitalize="off"