Engineering

Remove API keys and tokens from screenshots

Credentials often appear where the author is looking least: query strings, copied commands, browser developer tools, and collapsed environment panels.

Treat exposure as compromise

Redaction prevents further disclosure; it does not make an already exposed credential safe. Rotate a credential if it was shared with an unauthorized audience.

API keys and bearer tokens
Signed URLs
Session identifiers
Connection strings

Scan context, not only prefixes

Known prefixes are useful, but labels such as token, secret, authorization, and api_key also help identify credentials with unfamiliar formats.

Ready to check a file?

Open the isolated editor. No signup is required and the source file stays in your browser.

Open private editor