How to Hide Secrets in VS Code When Recording with ScreenFlow
ScreenFlow is the go-to screen recorder for Mac-based course creators. You record a polished tutorial, export it, upload to your course platform -- and then a student emails you: "I can see your database password at 12:47." Here is how to prevent that permanently.
Why ScreenFlow Users Are at Risk
ScreenFlow is designed for high-quality tutorial production. Its multi-track timeline, built-in annotations, and callout tools make it the preferred choice for instructors on platforms like Udemy, Teachable, and Skillshare. Telestream reports over 250,000 active ScreenFlow licenses, with a large portion used by developers creating programming courses.
The problem is specific to how tutorials are made: you walk through real code with real configurations. Unlike a slide deck, a coding tutorial requires a working project -- and working projects have real secrets in them. ScreenFlow's Display Recording captures everything on your screen, including every open file in VS Code, Cursor, Windsurf, or Antigravity.
The Course Creator's Dilemma
Course recordings are long. A single lesson might run 20-45 minutes, and a full course can involve 60+ recording sessions. Across all those hours, maintaining perfect operational security is nearly impossible. You will open a .env file to check a value, switch to a config file to debug a connection string, or accidentally hover over a terminal output that echoes a token.
Unlike a quick screen recording, courses are published permanently. They get sold for months or years. A secret visible in a single frame of a single lesson remains accessible to every future student who enrolls.
The Typical Workflow Without PixelHush
Most ScreenFlow tutorial creators use one of these approaches to deal with secrets:
- Pre-recording checklist -- Close all sensitive files, set environment variables to dummy values, clear terminal history. Takes 5-10 minutes per recording session, and you still forget things.
- Post-production blur -- ScreenFlow has a built-in blur tool. You scrub through footage, add blur annotations over secrets, and adjust their duration frame by frame. For a 30-minute lesson, this adds 15-30 minutes of editing.
- Separate "demo" environment -- Maintain a parallel project with fake credentials. This means two codebases, double the maintenance, and the demo frequently breaks because the fake values do not match real API behavior.
All of these approaches share the same flaw: they depend on you remembering to do them every single time.
production:
host: db-prod.us-east-1.rds.amazonaws.com
username: admin
password: Kx9$mP2vL!qR8nZw
database: myapp_production
The Automated Solution: PixelHush + ScreenFlow
PixelHush is a macOS menu bar app that detects when any screen recording begins and automatically masks secrets in your code editor. ScreenFlow detection requires PixelHush Pro (from $5/month or $49/year).
How ScreenFlow Detection Works
PixelHush uses process-level monitoring to detect when ScreenFlow is running. It identifies ScreenFlow by its bundle ID prefix (net.telestream.screenflow, covering all versions including ScreenFlow 10 and later) and immediately triggers secret masking in all connected editor extensions within approximately 50 milliseconds.
ScreenFlow detection requires a Pro license. PixelHush recognizes every ScreenFlow version by its bundle ID prefix (e.g., net.telestream.screenflow10).
ScreenFlow detection requires a Pro subscription (from $5/month or $49/year). The Free tier covers macOS Built-in, OBS Studio, Zoom, and Chrome. Upgrade to Pro for ScreenFlow, Loom, Screen Studio, CleanShot X, Discord, and the rest of the supported Pro apps. Every download starts with a 7-day Pro trial.
production:
host: ••••••••••••••••••••
username: ••••••••••••••••••••
password: ••••••••••••••••••••
database: ••••••••••••••••••••
Setup: PixelHush with ScreenFlow
- Install PixelHush PRO -- Download from pixelhush.dev. Drag to Applications. Activate your Pro license for ScreenFlow detection.
- Install the editor extension -- Open VS Code, Cursor, Windsurf, or Antigravity, go to Extensions, search "PixelHush", and install. The extension connects to the menu bar app automatically via local WebSocket on port 39271.
- Check the connection -- The VS Code status bar shows a PixelHush item with your plan and Off; it switches to On while a recording is detected. Supports VS Code, Cursor, Windsurf, and Antigravity.
- Record with ScreenFlow -- Open ScreenFlow. PixelHush masks secrets in your open editor files as soon as the app is running, before you start the recording.
- Stop and edit -- Stop the recording and edit your footage in ScreenFlow's timeline as normal -- no blur annotations needed. Secrets stay masked while ScreenFlow is open and unmask when you quit it.
.env next to it stays masked while the recording app runs.ScreenFlow Workflow: Before vs After PixelHush
Here is how PixelHush changes the typical course creation workflow with ScreenFlow:
| Workflow Step | Without PixelHush | With PixelHush |
|---|---|---|
| Pre-recording prep | 5-10 min closing files, setting dummy values | None needed |
| During recording | Constant vigilance about which files are open | Record naturally, switch any file |
| Post-production | 15-30 min adding blur per lesson | Zero secret-related editing |
| Risk of leaks | High -- one slip across 60+ recordings | Zero -- automatic system-level detection |
| Cost per course | 10-20 hours of extra editing | Pro — from $5/mo |
What PixelHush Masks
While a recording is detected, PixelHush protects .env files, config-style JSON (config.json, secrets.json, credentials.json, service-account keys), YAML, config TOML and shell scripts. In these files it masks every value by default, so it never has to guess which key is sensitive:
- API keys -- Stripe, OpenAI, AWS, Google Cloud, GitHub, Slack, Twilio, SendGrid, and more
- Database credentials -- PostgreSQL, MySQL, MongoDB, Redis connection strings with embedded passwords
- Authentication tokens -- JWT tokens, OAuth secrets, session keys, bearer tokens
- Infrastructure secrets -- SSH private keys, TLS certificates, Docker registry credentials
- Everything else in the file -- ports, hostnames and flags are masked too. Prefer to keep them readable? Turn on selective mode (
pixelhush.selective.enabled) and PixelHush masks only keys matching its 58 built-in patterns, such as*_KEY,*SECRET*and*PASSWORD*, plus values that look like tokens
ScreenFlow-Specific Tips for Course Creators
Use Display Recording Freely
ScreenFlow's "Record Desktop" mode captures your entire screen. With PixelHush running, you can use this mode without worrying about which editor tabs are visible. Switch between files, open terminal output, check config -- secrets are masked everywhere the PixelHush extension is installed.
Batch Recording Sessions
Course creators often record multiple lessons back-to-back. PixelHush handles repeated start/stop cycles seamlessly. Each time ScreenFlow begins a new recording, masking activates. Each time it stops, masking deactivates. No need to restart PixelHush between sessions.
Browser Dashboard Coverage
If your ScreenFlow tutorials include visiting AWS Console, Stripe Dashboard, or Firebase, install the PixelHush Chrome Extension. It masks secrets in web pages during recording, giving you full coverage across your editor and browser.
Retina and Multi-Monitor Support
ScreenFlow supports high-resolution Retina recording and multi-monitor setups. PixelHush's masking works at the editor level, not the pixel level, so it functions correctly regardless of your display configuration or ScreenFlow's recording resolution.
Stop leaking secrets. Start recording freely.
Join developers who share code safely every day with PixelHush.