[P0] Audit: Sensitive input warning is inconsistent across tools

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: tools that commonly handle sensitive material do not all use the same warning strength, location, or wording. Examples include JWT Decoder, JWT Workbench, JWT Signature Verifier, Certificate Decoder, Public Key/JWK tools, HAR Sanitizer, Log Scrubber, Env Variable Parser, HTTP Request Builder, Hash Generator HMAC mode, and image redaction tools.

Reproduction steps:

1. Open JWT Decoder, Log Scrubber, HAR Sanitizer, Certificate Decoder, HTTP Request Builder, and Hash Generator.
2. Compare trust badges, warning banners, helper text, and input placeholders.
3. Identify whether the page clearly says not to paste production secrets unless the local boundary is verified.
4. Check whether warnings appear near the input field, not only in the trust panel.

Expected behavior: every sensitive-input tool should show a consistent, visible, contextual warning near the relevant input control. The warning should link to Trust Center and explain local processing limits.

Actual behavior: some tools have trust labels and some have specialized warnings, but the visibility and wording are inconsistent.

Impact: users may paste production tokens, private keys, logs, HAR files, or confidential screenshots without fully understanding the risks. This weakens the privacy-first promise.

Proposed fix:

• Create a shared SensitiveInputNotice component.
• Render it near input areas for all sensitive tools.
• Include clear copy: “Do not paste production secrets unless you have verified the local processing boundary.”
• Link to Trust Center and DevTools verification instructions.
• Add tool manifest metadata for sensitive categories.
• Add tests to ensure sensitive tools render the notice.

Acceptance criteria:

• All sensitive-input tools show a consistent notice near the input.
• The notice links to Trust Center.
• Tool manifest drives whether the notice appears.
• Existing non-sensitive tools are not cluttered by unnecessary warnings.
• QA confirms no sensitive-input tool lacks a warning.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.