[Bug]: Playwright HTML Report Showing Password In Plain Text

[SoonerLR]

Version

1.52

Steps to reproduce

1. Update package.json to "@playwright/test": "1.51",
2. npm update
3. Run a test that uses locator.getByPlaceholder('Password').fill();
4. After the test runs, the HTML Playwright report does not show plain text password. It simply shows the code in Step 3 (locator.getByPlaceholder('Password').fill();
5. Update package.json to ""@playwright/test": "1.52" (or higher)
6. npm update
7. Run a test that uses locator.getByPlaceholder('Password').fill();
8. The HTML report does show the actual password in plain text instead like this:
   Fill "SomeLongRandomPlainTextPassword" getByPlaceholder('Password')

Expected behavior

When using locator.fill to enter a password into a HTML input type=password field, the HTML Playwright report should not display the password in plain text.

Actual behavior

The HTML Playwright report shows the password in plain text.

Additional context

This bug was introduced in version 1.52

This new bug prints the value of the input instead of the name of the input object like it did before. So now, my Playwright HTML reports show plain text username and passwords without giving me a way to hide/surpress them. If there is a way, please show me.

Environment

This is reproducable in both Windows and MacOs systems.

Here is my local info:
System:
    OS: macOS 15.5
    CPU: (12) arm64 Apple M2 Pro
    Memory: 152.83 MB / 32.00 GB
  Binaries:
    Node: 22.17.1 - ~/.nvm/versions/node/v22.17.1/bin/node
    npm: 11.4.2 - ~/.nvm/versions/node/v22.17.1/bin/npm
  Languages:
    Bash: 3.2.57 - /bin/bash
  npmPackages:
    @playwright/test: 1.51 => 1.51.1

I do not have the info from the Windows environment (Our Prod CI/CD)

[mxschmitt]

Folding into #35848. There is a note about secrets in https://playwright.dev/docs/ci-intro#properly-handling-secrets.

[SoonerLR]

Playwright changed the behavior of the HTML report, so now we, as the users of this platform, need to make infrastructure changes to fix an exposed password? A small paragraph on securing the reports is the answer?

Why can't we have a config option to turn it on or off as we see fit instead of making that choice for us and having us go explain to our security teams why passwords are showing up on the reports now but did not in the past.

This does not make sense to me to not give us the option for masking it in the reporters.

[SoonerLR]

@dgozman or @yury-s

Any update on this issue? There is no way it can just be closed for no reason. This is an issue. Just look at the support and history from your users. Can we at least have a discussion about it instead of just closing it and not addressing the security issue this has introduced?

[Shean92]

just found this today. Big problem, please fix. I have .env files that my playwright pulls info from. this does nothing and it just exposes the data anyway.