How to Hide Secrets in VS Code When Recording with OBS

The Problem: Secrets on Camera

OBS Studio is the most popular screen recording tool among developers. According to the 2024 Stack Overflow survey, over 40% of developers create some form of educational content -- tutorials, conference talks, internal demos, or onboarding videos. And most of them use OBS or its derivatives.

The issue is painfully simple: your .env files, config files, and credential stores are often open in your editor while you record. Even if you are careful, all it takes is one accidental tab switch to expose a secret. And unlike a live Zoom call, OBS recordings get uploaded to YouTube where they live forever.

Real-World Consequences

Leaked API keys are not hypothetical. GitGuardian's 2024 State of Secrets Sprawl report found that over 12.8 million new secrets were detected in public git commits -- and video content is an increasingly common vector. Bots scan YouTube transcriptions and OCR video frames for API key patterns. Once a key leaks, attackers can:

• Run up thousands of dollars in cloud charges within minutes
• Access private databases, S3 buckets, or user data
• Use your SMTP credentials to send phishing emails from your domain
• Pivot into your production infrastructure using one leaked token

Manual Solutions (and Why They Fall Short)

1. Close Sensitive Tabs Before Recording

The most common advice: just close your .env and config files before hitting record. In theory, this works. In practice, you will forget. Tutorial recordings can last 30-90 minutes, and you will inevitably open a file to check a value, forgetting the camera is rolling.

2. Use OBS Window Capture Instead of Display Capture

Window capture only records one specific window, so other applications are not visible. However, this does not help if the secrets are in the very editor window you are recording. And you lose the ability to show your terminal, browser, and editor in a natural workflow.

3. Blur in Post-Production

You can add blur rectangles in your video editor after recording. This technically works, but:

• You must manually scrub every frame where a secret appears
• It adds 30-60 minutes of editing per video
• You might miss a frame -- and one frame is enough for OCR
• It breaks your editing workflow and delays publishing

4. Use Environment Variable Substitution

Replace values with placeholders like YOUR_API_KEY_HERE before recording, then restore them after. This is fragile, error-prone, and means your app will not actually work during the demo.

The Automated Solution: PixelHush + OBS

PixelHush is a macOS menu bar application that detects when any screen recording starts -- including OBS Studio -- and automatically masks secrets in your code editor. No manual toggling, no forgetting, no post-production blur.

How OBS Detection Works

PixelHush uses Apple's ScreenCaptureKit framework to detect when any application initiates a screen capture. This is the same system-level API that macOS uses to show the recording indicator in the menu bar. When OBS (or any other app) begins capturing your screen, PixelHush receives the event in real time -- typically within 50 milliseconds.

The moment a recording session starts, PixelHush sends a signal to its editor extension (VS Code, Cursor, Windsurf, or Antigravity), which instantly replaces sensitive values with masked characters using the editor's Decoration API. The actual file content is never modified -- only the visual display changes.

Setup Guide: PixelHush with OBS Studio

1. Install PixelHush -- Download the macOS app from pixelhush.dev and drag it to your Applications folder. On first launch, grant the Screen Recording permission when prompted.
2. Install the editor extension -- Open VS Code, go to the Extensions panel, search for "PixelHush", and install. The extension connects automatically to the menu bar app via a local WebSocket on port 39271.
3. Verify the connection -- Look at the VS Code status bar. You should see a small PixelHush icon indicating "Connected." Supports VS Code, Cursor, Windsurf, and Antigravity.
4. Start OBS and record -- Open OBS Studio and start a recording or go live. Within milliseconds, you will see all detected secrets in your open editor files replaced with masked characters.
5. Stop recording -- When you stop the OBS recording, secrets are automatically unmasked and your editor returns to normal. No restart needed.

What Gets Hidden

PixelHush includes 48 built-in detection patterns covering the most common secret types across 7 file formats (.env, .json, .yaml, .toml, .xml, .properties, and .ini):

• API keys -- Stripe, OpenAI, AWS, Google Cloud, GitHub, Slack, Twilio, SendGrid, and more
• Database connection strings -- PostgreSQL, MySQL, MongoDB, Redis URIs with embedded credentials
• Authentication tokens -- JWT tokens, OAuth secrets, session keys, bearer tokens
• Infrastructure secrets -- SSH private keys, TLS certificates, Docker registry credentials
• Generic patterns -- Any key-value pair where the key contains "secret", "password", "token", or "key"

OBS-Specific Tips

Use Display Capture Confidently

With PixelHush active, you can use OBS Display Capture mode freely. Switch between your editor, terminal, and browser without worrying about which files are open. Secrets are masked everywhere PixelHush has an extension installed.

Chrome Extension for Browser Secrets

If you also show your browser during recordings -- visiting dashboards like AWS Console, Stripe Dashboard, or Firebase -- the PixelHush Chrome Extension masks secrets in web pages too. Install it from the Chrome Web Store to get full coverage.

Test Before Going Live

Before your first real recording session, do a short test recording with OBS. Open a file with dummy secrets, start recording, and confirm the masking activates. Check the footage to verify nothing slips through.

Streaming Considerations

PixelHush works equally well for live OBS streams to Twitch, YouTube, or any RTMP server. Since masking happens before the screen content is captured, your live viewers never see the secrets. This is critical for streaming, where there is zero opportunity for post-production editing.

Comparison: Manual vs Automated Protection