From a034202026bcc96b7ccd7d82bc928b89dfd0dd4f Mon Sep 17 00:00:00 2001
From: D-K-P <8297864+D-K-P@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:07:50 -0700
Subject: [PATCH] fix(webapp): disable browser autofill on environment variable
 inputs

The environment variable key and value inputs (create + edit) did not set
an autocomplete attribute, so browsers could offer to autofill or save
entered values as saved credentials. Set autoComplete="off" on those
inputs, matching the convention already used on the other credential-name
inputs in the app.
---
 .server-changes/env-var-inputs-autocomplete-off.md          | 6 ++++++
 .../route.tsx                                               | 2 ++
 .../route.tsx                                               | 1 +
 3 files changed, 9 insertions(+)
 create mode 100644 .server-changes/env-var-inputs-autocomplete-off.md

diff --git a/.server-changes/env-var-inputs-autocomplete-off.md b/.server-changes/env-var-inputs-autocomplete-off.md
new file mode 100644
index 00000000000..a17457cbd42
--- /dev/null
+++ b/.server-changes/env-var-inputs-autocomplete-off.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Stop the browser offering to autofill or save environment variable values as saved credentials.
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx
index 6a87b4b14e7..0204820ff57 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx
@@ -677,6 +677,7 @@ function VariableField({
             onChange={(e) => onChange({ ...value, key: e.currentTarget.value })}
             autoFocus={index === 0}
             onPaste={onPaste}
+            autoComplete="off"
           />
           <FormError id={fields.key.errorId}>{fields.key.errors}</FormError>
         </div>
@@ -689,6 +690,7 @@ function VariableField({
               placeholder="Not set"
               value={value.value}
               onChange={(e) => onChange({ ...value, value: e.currentTarget.value })}
+              autoComplete="off"
             />
             <FormError id={fields.value.errorId}>{fields.value.errors}</FormError>
           </div>
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx
index 617dc577b80..1974e2051fb 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx
@@ -865,6 +865,7 @@ function EditEnvironmentVariablePanel({
                 placeholder={variable.isSecret ? "Set new secret value" : "Not set"}
                 defaultValue={variable.value}
                 type={"text"}
+                autoComplete="off"
               />
               <FormError id={value.errorId}>{value.errors}</FormError>
             </InputGroup>