Hide an API key in the URL bar before you screenshot

The tab title says “Dashboard.” The address bar says ?token= and a string that is a password.

Cover the whole chrome. Query strings, hash fragments, localhost ports that reveal internal hostnames, sk_live, AWS keys in a tutorial you should not have photographed.

People bar the table and leave the URL. The table was dummy data. The URL was not. Browser chrome is part of the screenshot. Treat it as a field you chose to publish.

What belongs under a bar in the URL bar?

Anything after ? or # that you would rotate: session tokens, magic links, invite codes, access_token, reset secrets. Hostnames that are not public: internal package names, staging boxes, .local, VPN-only DNS. Ports that advertise an admin UI. Paths that include tenant IDs or user IDs you do not need in the ticket. Usernames embedded in basic-auth URLs. Prefixed keys that look like sk_live, AKIA, or a GitHubghp_ string sitting in a docs page you opened to debug.

If you only needed to show “we were on checkout,” bar the query and leave the path, or describe the path in text. A screenshot is not a requirement to paste a live credential into GitHub.

Why do bug-report screenshots get scraped?

Engineers paste screenshots into GitHub. Public issues are public. Secret scanning and opportunistic scrapers both exist. Rotate anything that appeared, even under a bar you are not sure about. A bar that missed one character of a token is a live token. Bug-report guide.

Internal tickets get forwarded to vendors. Vendors attach them to their tickets. The PNG leaves the company. Assume that path. Bar the chrome before the first attach.

Is Discord plus DevTools a special case?

It is a frequent combo: a console error, a network panel with Authorization headers, a localStorage dump in a screenshot meant to show a red stack trace. Cover the header column. Cover the request URL. Cover cookies. The stack trace is usually the only part the maintainer needs. Discord.

The same panel in Slack, Teams, or a forum post is the same panel. The product name of the chat is not the leak. The bearer token is.

Does cropping the address bar beat painting it?

Crop if you do not need chrome at all. Paint if you need to show you were on a host. Cropping a tall DevTools shot and leaving the request list is not cropping the secret. Look at every remaining line.

Full-page captures are worse. They include every tab title. Tab titles include unread mail counts and the names of people. Bar or crop the tab strip.

Should you rotate after a barred screenshot?

If the credential was on screen, rotate when you cannot prove the pixels were replaced. A highlighter over a URL is not proof. A PNG fill you inspected at zoom is closer. Rotation is cheaper than treating a public issue as a password manager. When in doubt, rotate and bar the next shot before you post the follow-up.

What about keys that sit in the page, not the chrome?

Config files, .env dumps, tutorial READMEs with a real key pasted “just for a second,” QR codes that encode the same secret. Bar those regions the same way. The address bar is the surprise. The body is the obvious one people still miss because they circled the error in red and forgot the panel next to it.

Network waterfalls show full URLs. Response JSON shows emails. Local storage panels show session blobs. If the maintainer needs one stack frame, crop to that frame after you bar identifiers. Do not send the entire DevTools window because it felt thorough. Thorough is how tenant IDs travel. A red circle around the error does not hide the Authorization column. Paint the column. Then crop.

Paint the chrome before the file leaves the tab. A missed query string is a live session. Inspect the download at the top of the window, then attach only that PNG: cover the address bar in BlurThis.