OTP input is exposed to Android Autofill as a username

[cassi-volkova]

Environment

Android app 1.0.5 (versionCode 14) from commit d03af65, tested on a physical Pixel 5 running Android 14.
Password login with an OTP challenge was enabled.

Reproduction

1. Sign in with username and password.
2. Enter the one-time code in the OTP field.
3. Complete login.
4. Observe the Android Autofill save prompt.

Actual result

Autofill identifies the one-time code as the username and offers to save the OTP together with the password.

Expected result

The OTP field is marked as a one-time code and excluded from credential saving. The actual username remains the username field.

Impact

The UI encourages saving an expired secret as a reusable account identifier and can overwrite useful credential metadata.