How to Hide API Keys During Zoom Screen Sharing
Live Zoom calls are the highest-stakes environment for accidental secret exposure. You cannot edit a live stream. You cannot add blur after the fact. Every participant sees exactly what is on your screen, in real time.
Why Zoom Screen Sharing Is Different
Recording a tutorial with OBS is risky, but at least you have a safety net: you can review footage and blur secrets before publishing. Zoom screen sharing offers no such luxury. The moment you share your screen in a standup, a sprint demo, or a client call, everyone on the call sees your editor -- secrets and all.
This creates three distinct threat scenarios that most developers do not think about until it is too late:
You share your screen to walk through a bug fix. You flip to the .env file to show a configuration change. Your production database password is right there, visible to the entire team -- including contractors, interns, and that new hire who has not signed the security agreement yet.
You are demoing a feature to a client over Zoom. You open VS Code to show the integration. The client's own API key is visible in your config file -- but so is another client's key, your Stripe secret, and your AWS credentials. The client screenshots your screen.
Your company records all Zoom meetings for compliance. That recording sits in the cloud, accessible to anyone with the meeting link. Six months later, an employee leaves, but the recording with your production secrets is still available to them.
Zoom cloud recordings and local recordings are searchable by anyone in your organization. Many companies enable automatic recording, meaning your screen share is being captured even if you did not realize it. Secrets in those recordings persist indefinitely.
Why Manual Approaches Fail for Live Calls
You Cannot Pause to Prepare
In a recorded tutorial, you can carefully set up your environment before hitting record. In a live Zoom call, someone says "Can you share your screen and show me that code?" and you have about 5 seconds before it looks awkward. There is no time to close tabs, switch branches, or substitute placeholder values.
Context Switching Kills Preparation
Even if you prepare before a call, live debugging often requires opening files you did not plan to show. A teammate says "Can you check the database config?" and suddenly you are navigating to the one file you meant to avoid.
Zoom Records Everything
If your organization uses Zoom cloud recording (and most enterprise environments do), every screen share is captured and stored. Unlike a YouTube video where you control when to publish, these recordings are created and stored automatically -- often before you even realize the recording was running.
How PixelHush Protects Zoom Screen Shares
PixelHush detects Zoom's screen capture at the macOS system level using ScreenCaptureKit. The moment you click "Share Screen" in Zoom, PixelHush recognizes the new screen capture session and signals your VS Code, Cursor, Windsurf, or Antigravity extension to mask all detected secrets.
This happens in real time -- typically within 50 milliseconds of starting the screen share. By the time Zoom's screen share animation finishes and participants can see your screen, all secrets are already masked.
What Makes This Different from a Toggle
Extensions like Cloak or DotENV Mask require you to manually activate masking with a keyboard shortcut or command. That manual step is the failure point. PixelHush removes the manual step entirely. You do not need to remember, and you cannot forget.
database:
host: prod-db.internal
port: 5432
username: app_service
password: ••••••••••••••••
stripe:
secret_key: ••••••••••••••••
webhook_secret: ••••••••••••••••
aws:
access_key_id: AKIA••••••••••••
secret_access_key: ••••••••••••••••
Setup Guide: PixelHush for Zoom Calls
- Install PixelHush -- Download from pixelhush.dev. Drag to Applications. On first launch, grant Screen Recording permission.
- Install the editor extension -- Search "PixelHush" in the extension marketplace (VS Code, Cursor, Windsurf, or Antigravity). The extension connects to the menu bar app automatically via local WebSocket.
- Optional: Install Chrome Extension -- If you show dashboards or admin panels during calls, the Chrome Extension will mask secrets in your browser too. Covers AWS Console, Stripe Dashboard, Firebase, Vercel, and more.
- Join your Zoom call normally -- No special preparation needed. PixelHush sits in your menu bar and monitors for screen capture events.
- Share your screen -- The moment Zoom begins capturing your screen, PixelHush activates masking across all connected editors and the browser. Participants see masked values from the very first frame.
Best Practices for Secure Zoom Screen Sharing
Even with PixelHush protecting your editor, here are additional practices to minimize risk during live screen shares:
1. Use Zoom's "Share Specific Window" Option
Instead of sharing your entire screen, share only the window you need to show. This prevents participants from seeing notifications, other applications, or your desktop. Combined with PixelHush (which masks secrets within the shared window), this creates a strong two-layer defense.
2. Disable Notifications Before Calls
macOS Focus modes (Do Not Disturb) prevent notification pop-ups that might contain sensitive content -- email previews, Slack messages with credentials, or password manager notifications. Enable Focus mode before any screen-sharing session.
3. Use a Separate Browser Profile for Demos
Create a Chrome profile specifically for demos and screen shares. This profile should not be logged into your personal email, cloud dashboards, or banking sites. Autofill will not suggest your credentials, and bookmarks will not reveal internal tools.
4. Be Aware of Zoom Cloud Recordings
Check your organization's Zoom settings. If automatic cloud recording is enabled, every call with screen sharing is being recorded and stored. Make sure your security posture accounts for these persistent recordings, not just the live call.
5. Audit After Calls
If you showed code during a call and did not have PixelHush running, do a post-call audit. Check which files were visible, whether any contained secrets, and if so, rotate those credentials immediately. It only takes minutes but can prevent a breach.
Start a test Zoom meeting with just yourself. Share your screen and verify that PixelHush activates. Open a file with test secrets and confirm they are masked. This takes 2 minutes and gives you full confidence before a real call.
Supported Zoom Configurations
PixelHush detects screen sharing across all Zoom configurations on macOS:
- Zoom Desktop App -- Full screen share, window share, and portion share
- Zoom Webinars -- Screen sharing as a presenter or panelist
- Zoom Breakout Rooms -- Screen sharing within breakout rooms
- Zoom Recordings -- Both local and cloud recordings capture the masked view
PixelHush also works with Google Meet, Microsoft Teams, Discord, and any other video call application that uses macOS screen capture APIs.
