![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 7 weeks ago
Closed 5 weeks ago
#65303 closed defect (bug) (reported-upstream)
API Key is exposed in browser autofill/autocomplete suggestion dropdown on integration setup form
| Reported by: | modi2918 | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Editor | Version: | |
| Severity: | normal | Keywords: | close |
| Cc: | Focuses: |
Description
When entering an API key in the integration setup form (Anthropic provider), the API key value appears in the browser autocomplete/autofill suggestion dropdown in plain text. This can expose sensitive credentials to anyone with access to the browser session or screen.
The API key field should behave like a secure password field and should not display previously entered values as suggestions.
Steps to Reproduce:
Open the AI integration settings page.
Navigate to the Anthropic API key setup section.
Click inside the “API KEY” input field.
Browser displays previously entered API keys in autocomplete suggestions.
Actual Result:
Previously entered API keys are visible in browser suggestion/autocomplete dropdown.
Expected Result:
API keys should never appear in autocomplete suggestions or stored browser history.
The field should:
Use secure input masking (type="password")
Disable autocomplete (autocomplete="off" or autocomplete="new-password")
Prevent sensitive values from being exposed in browser suggestions
Impact:
Sensitive API credentials can be exposed visually
Risk of credential leakage during screen sharing or shared device usage
Security/privacy concern for users managing third-party integrations
Suggested Fix:
Change API key input field to password type
Disable browser autocomplete/autofill for the field
Optionally add a show/hide toggle for usability
Ensure keys are not cached in frontend storage unnecessarily
Environment:
Browser: Chrome (observed)
Module: AI Integration Settings
Provider: Anthropic
Attachments (1)
Change History (7)
#2
@
5 weeks ago
- Component AI → Editor
- Focuses ui administration removed
- Milestone Awaiting Review
- Resolution → reported-upstream
- Status new → closed
This issue was reported in https://github.com/WordPress/gutenberg/issues/78965.
The UI for the connectors screen is generated from code in the Gutenberg repository. Can you please report this issue there? Once that has been done, this can be closed as
reported-upstream