From 1f53ed3b43f2b3eb28bb88967b7370386ac03238 Mon Sep 17 00:00:00 2001
From: David Beentjes <david@unloc.nl>
Date: Tue, 18 Aug 2026 14:36:56 +0200
Subject: [PATCH] Mask a secure bare text input on Android

The bare renderer builds its own BasicTextField and never passed
visualTransformation, so `secure` parsed but never reached the field
and the password rendered in the clear. Outlined and filled already
pass it; iOS is unaffected because its bare renderer delegates to
NativeUITextInputCore.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 resources/android/BareTextInputRenderer.kt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/resources/android/BareTextInputRenderer.kt b/resources/android/BareTextInputRenderer.kt
index a52a7ef..a92d0d6 100644
--- a/resources/android/BareTextInputRenderer.kt
+++ b/resources/android/BareTextInputRenderer.kt
@@ -146,6 +146,7 @@ object BareTextInputRenderer {
                 }
             ),
             singleLine = !props.multiline,
+            visualTransformation = props.visualTransformation,
             decorationBox = { innerTextField ->
                 if (value.text.isEmpty() && props.placeholder.isNotEmpty()) {
                     Text(