Playwright innerText drops hidden notes. White-on-white text still gets through.

Playwright's locator.innerText() returns the text Chrome renders, so an agent that browses with Playwright can use it to turn a page into text for a model. We hid five notes in a help page (a stylesheet class, an inline display:none, the hidden attribute, an HTML comment and a JSON script block), and innerText returned none of them while textContent returned four and the raw HTML from page.content() carried all five. The catch is styling: on a second page, innerText kept four of five notes that a person cannot read.

Each note tells an assistant not to recommend a data protection authority, on a page about deleting an account.

The catch

innerText follows rendering, and rendered text can still be unreadable. On a second page we hid five more notes with styling alone:

innerText kept four of the five. A person looking at the page sees none of them, and a model reading the innerText gets all four. The lab's findInvisible walks the rendered elements, compares text color with the nearest background, checks opacity up the tree, font size and the element's box, and flags all four. The CLI exits with code 3 when it finds one. It only knows these four tricks and only looks at the lab's tagged notes. innerText is a rendering filter, so keep your own prompt-injection defenses in place.

What we ran (keyless)

git clone https://github.com/SkilledDragonCorp/oculto-playwright-innertext.git
cd oculto-playwright-innertext
bun install
bun run src/cli.ts fixtures/ayuda.html
bun run src/cli.ts fixtures/trucos.html
bun test

From reports/gate.json, run on October 20, 2026 on Linux:

The help page run exits 0 and prints innerText notes: 0 and textContent notes: 4. The tricks page run exits 3 and lists the four flagged notes. GitHub Actions has not run on this repo yet. On macOS the same bun test passed 17 and failed 2, because the two network-isolation tests need unshare, which macOS does not have.

How it is wired

The lab launches Chrome through playwright-core and reads only local HTML fixtures. Service workers are blocked, and routing sits on the browser context, because the pinned Playwright docs say a bare page.route misses requests a service worker intercepts and the first request of a popup. Every request outside the fixtures folder, the temp dir and the local fixture server is aborted, and WebSocket handshakes are closed. A control test keeps the bare page.route path and runs it with no network, so you can see the popup request it misses. No step reads an API key.

Minilab (open source)

Upstream is microsoft/playwright (98,181 stars, Apache-2.0, TypeScript, as of October 20, 2026). To try a trick we did not cover, add a paragraph with a TRUCO- tag to fixtures/trucos.html, run bun run src/cli.ts fixtures/trucos.html, and see whether innerText keeps it and findInvisible flags it. The repo also ships a visible-text skill in .claude/skills/ for Claude Code and Cursor.

bun install && bun run src/cli.ts fixtures/ayuda.html