How to Hide Secrets When Using CleanShot X for Screenshots and Recording
CleanShot X is the go-to screenshot and recording tool for Mac power users. But every time you capture your screen for documentation, bug reports, or tutorials, your API keys, tokens, and database credentials are at risk of being included in the capture.
Why CleanShot X Creates Unique Security Risks
CleanShot X is not just another screenshot tool. It is a workflow accelerator that developers rely on daily -- for filing bug reports, building documentation, creating internal guides, and recording quick walkthroughs. The very speed that makes it valuable also makes it dangerous: you capture first and think later.
Unlike screen sharing where you might mentally prepare before clicking "Share," CleanShot captures happen reflexively. A keyboard shortcut, a quick drag, and the capture is done. There is no preview moment where you might notice that .env file open in the background.
A QA engineer asks you to capture the error state. You hit your CleanShot shortcut and grab the full window. The error message is in the terminal -- but so is the database connection string you used to reproduce the bug. That screenshot goes straight into Jira, accessible to the entire team and every external contractor with project access.
You are writing setup docs for a new service. You capture your VS Code window to show the project structure and config files. The screenshot includes your .env.local with real API keys because you forgot to switch to the example config. That screenshot ends up in Confluence or Notion, visible to the entire organization -- forever.
You use CleanShot's recording feature to create a quick walkthrough for a colleague. During the recording, you open a config file to show where to add an API key. Your real production key is visible for three seconds in a 90-second video. You do not notice it when reviewing. That video gets shared in Slack.
Unlike a live screen share that exists only in memory, screenshots and recordings are files. They get uploaded to Jira, Notion, Confluence, Slack, GitHub issues, and documentation sites. They get indexed, cached, and backed up. A secret in a screenshot from 2024 can surface in a Google search in 2026.
How PixelHush PRO Detects CleanShot X
PixelHush PRO monitors macOS screen capture activity at the system level using ScreenCaptureKit. CleanShot X uses a specific window layer (layer 103) for its capture overlay, and PixelHush recognizes this as an active screen capture session.
The moment CleanShot X begins a capture -- whether it is a screenshot, scrolling capture, or screen recording -- PixelHush signals your VS Code, Cursor, Windsurf, or Antigravity extension to mask all detected secrets. This happens in under 50 milliseconds, before the first frame is captured.
Both Screenshots and Recordings Are Protected
This is a critical distinction. Many "solutions" for screen recording do not help with screenshots because they rely on a visible recording indicator or a toggle you activate before recording. PixelHush detects the actual screen capture event at the OS level, so it protects against both modes equally.
CleanShot X detection is available in PixelHush PRO. The free tier detects OBS, QuickTime, and Zoom. PRO adds detection for CleanShot X, Loom, browser screen sharing, and all other screen capture applications.
What Gets Protected
PixelHush masks secrets across all file types that developers commonly capture in screenshots and recordings:
# .env file
DATABASE_URL=••••••••••••••••
STRIPE_SECRET_KEY=••••••••••••••••
AWS_SECRET_ACCESS_KEY=••••••••••••••••
OPENAI_API_KEY=••••••••••••••••
# config.yaml
database:
password: ••••••••••••••••
redis:
auth_token: ••••••••••••••••
# settings.json
"apiKey": "••••••••••••••••"
"webhookSecret": "••••••••••••••••"
Setup Guide: PixelHush for CleanShot X
- Install PixelHush PRO -- Download from pixelhush.dev. Drag to Applications. On first launch, grant Screen Recording permission. Activate your PRO license for CleanShot X detection.
- Install the editor extension -- Search "PixelHush" in the extension marketplace (VS Code, Cursor, Windsurf, or Antigravity). The extension connects to the menu bar app automatically via local WebSocket.
- Use CleanShot X normally -- No workflow changes needed. PixelHush runs silently in your menu bar and monitors for screen capture events from CleanShot X.
- Capture with confidence -- Whether you take a screenshot, scrolling capture, or screen recording, PixelHush masks all secrets before the first pixel is captured. Your CleanShot workflow stays exactly the same.
Best Practices for Secure Screenshots and Recordings
1. Use Annotations to Draw Attention Away from Sensitive Areas
CleanShot X has excellent annotation tools. If your screenshot unavoidably includes an area near sensitive data, use arrows and highlights to direct the viewer's eye to the relevant part. Combined with PixelHush masking the actual values, this creates a layered defense.
2. Prefer Window Capture Over Full Screen
CleanShot X offers area capture, window capture, and full screen capture. When documenting code, use window capture to grab only the editor window. This avoids accidentally including other applications that might display secrets -- like a terminal with connection strings or a browser with a cloud dashboard.
3. Review Before Sharing
CleanShot X shows a floating preview after each capture. Use this moment to glance at the image before dragging it into Slack, Jira, or your docs. With PixelHush running, secrets should be masked, but a quick visual check adds an extra safety layer.
4. Set Up a Clean Screenshot Profile
If you frequently take screenshots for public documentation or blog posts, consider creating a dedicated VS Code workspace with only example configurations and placeholder values. Use this workspace for any captures that will be widely distributed.
5. Audit Your Existing Screenshots
If you have been using CleanShot X without PixelHush, search your cloud storage, Jira tickets, and documentation for screenshots that may contain exposed secrets. Any credentials visible in old screenshots should be rotated immediately.
Open a file with test secrets in VS Code, then take a CleanShot screenshot. Verify in the CleanShot preview that all secrets appear masked. This takes 30 seconds and confirms everything is working before you capture real content.
What About CleanShot's Built-In Blur?
CleanShot X includes a blur annotation tool that you can apply after taking a screenshot. This is useful for ad-hoc redaction, but it has fundamental limitations compared to PixelHush:
- It is manual -- You must remember to blur each secret in each screenshot. Miss one and it ships.
- It does not work for recordings -- You cannot blur individual frames in a CleanShot screen recording after the fact.
- It is error-prone -- Selecting the exact area to blur is imprecise. You might blur too little and leave part of a key visible, or blur too much and obscure the context you wanted to show.
- It does not scale -- If you take 20 screenshots a day for documentation, manually blurring secrets in each one is unsustainable.
PixelHush solves all of these issues by masking secrets before the capture happens, not after.
Stop leaking secrets. Start recording freely.
Join thousands of developers who share code safely every day with PixelHush.