Stop Leaking Secrets in Screen Recordings: A Privacy Checklist for Demos, Tutorials and Bug Reports

A developer records a two-minute walkthrough of a new API integration and posts it in a public channel. Forty seconds in, a terminal shows an .env file, with a live secret key on screen for three seconds. Nobody notices until the bill arrives.

It's one of the most common ways secrets leak, and one of the least talked about. Screen recordings are everywhere: demos, tutorials, onboarding videos, bug reports, sales follow-ups, async standups. Each one is a few minutes of your actual screen, often shared with people outside your company.

This guide covers what typically leaks, why "I'll blur it afterwards" often fails, and a checklist for recording safely.

What actually leaks

Some of these are obvious. Most aren't, because they're on screen for a second and you stopped seeing them years ago.

Credentials and secrets

• API keys and tokens in terminals, config files, environment variables and dashboard settings pages
• Passwords shown with a "reveal" toggle, or typed into a field that briefly shows the last character
• Session tokens and keys in URLs, visible in the address bar
• SSH hosts, internal IP addresses and database connection strings

Personal data

• Customer names, email addresses and phone numbers in admin panels, CRMs and support tools
• Card numbers, IBANs and invoice amounts in billing screens
• Faces, yours and other people's, in a video call or a camera bubble

Things you forgot were there

• Notification banners: a Slack DM preview, a calendar invite, a text message
• Browser autocomplete dropdowns showing your history as you type a URL
• Other tabs' titles and the bookmarks bar
• Recent files in an app's sidebar or open-file dialog
• Your desktop: file names, screenshots, folders called Layoffs or Acquisition

Spoken secrets

• Saying a customer's name, a password or an internal project name out loud. If you transcribe and caption the video, it's now in writing too.

Why "I'll blur it later" often fails

Blurring afterwards is better than nothing. But it has several weak spots.

You have to find every frame. A secret might be on screen for a second while you scroll. Scrubbing through a ten-minute video frame by frame is tedious, and people miss things.

Things move. A blur box drawn over a field covers that field until you scroll. Then the text moves out from under the box and is in plain view for the rest of the scroll.

Some blurs aren't permanent. In some tools, a blur is a layer in the project, not a change to the pixels. Share the project file, or export the wrong version, and the original is there.

Weak blur and pixelation can sometimes be reversed. Security researchers have shown that lightly pixelated text can, in some cases, be reconstructed. For anything truly sensitive, such as keys and passwords, use a solid bar rather than a blur.

Cloud redaction means uploading the unredacted video. If the tool that finds and blurs secrets runs in the cloud, the original, with every secret still in it, has to leave your machine first. For many teams that defeats the point.

The checklist

Before you record

• Use a demo account and demo data. This one habit prevents most leaks. Make a test workspace with fictional customers, and keep it ready for recordings.
• Use test or restricted API keys in anything you'll show on screen, never production keys.
• Close what you don't need. Every app, every tab. Hide the bookmarks bar.
• Turn on Do Not Disturb. Notifications are the most common surprise.
• Hide desktop icons, or record a single window rather than the whole display.
• Clear or avoid the address bar. Type URLs into a fresh profile, or navigate by clicking rather than typing so autocomplete doesn't show your history.
• Check what your camera sees behind you: whiteboards, sticky notes, other screens, other people.

While you record

• Don't reveal secrets, even "just for a second". Show the field, say "paste your key here", and paste a dummy one.
• Don't say private things out loud. Customer names, internal codenames, amounts.
• Pause the recording to switch to anything sensitive, then resume.

Before you share

• Watch the whole video once, at normal speed, looking only for private details. Not for pacing, not for typos. Just secrets.
• Search the transcript if you have one, for names, emails, "key", "token", "password".
• Redact with burnt-in masks: blur or pixelate for general details, solid bars for credentials. Make sure the masks follow content when it scrolls.
• Export a new file and share that, never the project.
• If a real secret was ever on screen, rotate it. Even if you redacted it, and even if the video was only shared internally. Rotating a key takes two minutes; finding out it was in a video six months later doesn't.

How ZumCast handles this

We built ZumCast for people who record their real dashboards, so privacy is part of the recorder rather than a separate tool.

It finds private details for you, on your Mac. Open Privacy in the Studio, or ask Zumi, the AI editor, to "blur anything private". ZumCast reads the screen and finds email addresses, phone numbers, card numbers, IBANs, API keys and other secrets, IP addresses and faces, plus money amounts and names if you turn those on. You check what it found, untick anything you want to keep, and apply. The scan runs on your Mac; nothing is uploaded to look for secrets.

Masks follow the content. Choose blur, pixelate or a solid bar. In video, the mask follows the text as the page scrolls, so a scroll doesn't uncover it.

Redaction is burnt in. Masks are part of every exported pixel. The hidden part is never in the file, so there's no layer to remove.

Typing isn't recorded. ZumCast notes that you typed, to zoom in on the field, and shows ⌘ and ⌃ shortcuts on screen if you want. The characters you type are never stored.

Bug reports scan automatically. The Bug report project type runs a privacy scan on every recording, because bug reports are exactly where real customer data shows up.

Screenshots too. The same scan works on screenshots, and the shot editor has a blur tool for anything you want to hide by hand.

The airplane test. Recording, transcripts, captions, redaction and Zumi's planning all run on your Mac, and they all work with Wi-Fi off. Something leaves your Mac only when you choose to share it.

The short version

1. Record with demo data and test keys.
2. Turn off notifications and close everything else.
3. Watch the whole video once, looking only for secrets.
4. Redact with burnt-in masks that follow scrolling; use solid bars for credentials.
5. Share an exported file, never the project.
6. If a real secret was on screen, rotate it.

---

ZumCast is a Mac screen recorder with an AI editor that runs on your Mac. It finds and blurs emails, keys, card numbers and faces on your Mac, burns the masks into every export, and never uploads your recording to edit it. The Basic version is free; Pro is a one-time purchase. Download it free.