Use getpass for secret prompts in all auto-collectors

[titanwings]

Problem

The --setup flow of every auto-collector reads API tokens and passwords via input(), which echoes characters to the terminal and leaves them in shell scrollback / session recordings.

Example from tools/confluence_auto_collector.py:

api_token = input("API Token: ").strip()    # visible
password = input("Password: ").strip()      # visible

Same pattern exists in the Feishu, Slack, and DingTalk collectors.

Proposed fix

Use getpass.getpass() for any prompt that reads a secret (token, password, app secret). Display name / email / URL can stay as input().

from getpass import getpass

api_token = getpass("API Token: ").strip()
password = getpass("Password: ").strip()

Affected files

• tools/feishu_auto_collector.py
• tools/slack_auto_collector.py
• tools/dingtalk_auto_collector.py
• tools/confluence_auto_collector.py (pending PR feat: add Confluence auto-collector as new data source #106)

Why good-first-issue

Two-line change per file. Minimal Python knowledge required. A great way to submit your first PR while learning the codebase.

Acceptance criteria

• Every secret prompt uses getpass.getpass()
• Non-secret prompts (name, email, URL) remain input()
• A short note in CONTRIBUTING.md under Security: "always use getpass for secret prompts"