Unsafe paste confirmation should not reveal contents in UI by default in secure input mode

[mitchellh]

Discussed in #4873

^{Originally posted by cryptocode January 9, 2025}
In the image below (where I've cut off the password) I pasted a password with special characters for an ssh session, while in secure input "padlock mode"

The macOS secure input and padlock is a great feature that doesn't echo the password, so it's a bit of a bummer that the paste warning shows the password in clear text.

I feel like the warning should be suppressed, or at least not show the pasted value when in padlock mode.

Solution

We should send information along with the paste confirmation request of whether the paste contents are considered sensitive or part of secure input. If so, our UIs should hide the contents by default.