[P1] Audit: Hash Generator HMAC mode should hide shared secrets and add stronger privacy warnings

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: Hash Generator includes HMAC mode, which requires a shared secret. Secret input should be treated differently from normal text input. Users should not see shared secrets displayed as regular text by default, and the tool should make local-only handling and clipboard risks explicit.

Affected URL:

• https://byteflow.tools/en/hash-generator

Reproduction steps:

1. Open Hash Generator.
2. Switch from Text Hash to HMAC mode.
3. Enter a dummy shared secret and payload.
4. Inspect input visibility, copy behavior, warnings, and storage.
5. Check whether the UI warns about not using production secrets.

Expected behavior: HMAC secret input should be masked by default, with a show/hide control and strong privacy guidance.

Actual behavior: HMAC mode does not provide enough secret-specific UI behavior and warning clarity.

Impact: users may expose secrets in screen recordings, shared screens, screenshots, or shoulder-surfing situations.

Proposed fix:

• Use password-style input for HMAC secret by default.
• Add show/hide secret toggle.
• Add warning near secret input: “Use dummy or rotated secrets for debugging.”
• Ensure secret is never stored in localStorage, sessionStorage, URL, recipe exports, or analytics.
• Add test coverage for storage and export behavior.

Acceptance criteria:

• HMAC secret field is masked by default.
• User can reveal/hide secret intentionally.
• Secret-specific privacy warning is visible.
• No secret is persisted or exported by default.
• HMAC output remains accurate for supported algorithms.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.