diff --git a/.gitignore b/.gitignore
index 567609b..d532bdd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 build/
+subprojects/
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 0000000..949328d
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,9 @@
+{ pkgs ? import <nixpkgs> {} }:
+
+pkgs.mkShell {
+    name = "wl-clipboard-shell";
+    buildInputs = [
+        pkgs.meson
+        pkgs.ninja
+    ];
+}
diff --git a/src/util/string.c b/src/util/string.c
index bfea1de..4e98233 100644
--- a/src/util/string.c
+++ b/src/util/string.c
@@ -55,6 +55,12 @@ int mime_type_is_text(const char *mime_type) {
     return basic || common || special;
 }
 
+int mime_type_is_sensitive(const char *mime_type) {
+    /* A heuristic to detect sensitive mime types */
+    
+    return strcmp(mime_type, "x-kde-passwordManagerHint");
+}
+
 int str_has_prefix(const char *string, const char *prefix) {
     size_t prefix_length = strlen(prefix);
     return strncmp(string, prefix, prefix_length) == 0;
diff --git a/src/util/string.h b/src/util/string.h
index 1477944..08307d1 100644
--- a/src/util/string.h
+++ b/src/util/string.h
@@ -25,6 +25,7 @@
 typedef char * const *argv_t;
 
 int mime_type_is_text(const char *mime_type);
+int mime_type_is_sensitive(const char *mime_type);
 
 int str_has_prefix(const char *string, const char *prefix);
 int str_has_suffix(const char *string, const char *suffix);
diff --git a/src/wl-paste.c b/src/wl-paste.c
index dee2fad..7fdf332 100644
--- a/src/wl-paste.c
+++ b/src/wl-paste.c
@@ -275,6 +275,15 @@ static void selection_callback(struct offer *offer, int primary) {
         exit(0);
     }
 
+    int sensitive = 0;
+
+    offer_for_each_mime_type(offer, mime_type) {
+        if (mime_type_is_sensitive(mime_type) == 0) {
+            sensitive = 1;
+            break;
+        }
+    }
+
     struct types types = classify_offer_types(offer);
     const char *mime_type = mime_type_to_request(types);
 
@@ -319,7 +328,7 @@ static void selection_callback(struct offer *offer, int primary) {
     wl_display_flush(wl_display);
 
     close(pipefd[1]);
-    rc = run_paste_command(pipefd[0], "data");
+    rc = run_paste_command(pipefd[0], sensitive == 1 ? "sensitive" : "data");
     if (!rc) {
         if (options.watch) {
             /* Try to cope without exiting completely */