r-zakarya
3f07c1217b
The note textarea showed its plaintext to anyone glancing at the screen, unlike every other secret in the editor. An eye button on the NOTE label masks it with -webkit-text-security (a textarea has no type="password"). The button IS the setting: it flips state.maskNotes, which is synced via settings_json, so the choice sticks across entries and devices — no extra Settings row for a one-bit preference. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
