hidden password bug