Keeping secrets off screen
This page is for every creator who records or shares a screen. One frame with a password or a key is enough for someone to use it, and recordings, clips and screenshots last for years. The safest secret is one that is not on the machine you show. This page lists where Exponential's secrets show up, so you can keep them out of the picture.
Contents
- Never on screen
- Where secrets show up in Exponential
- Prepare the machine
- During recording
- If something leaks
Never on screen
- Passwords of any account, including the one you type into the sign-in form.
- The generated administrator password and the file
var/log/initial-admin-password. - Provider keys (for example for Exponential Intelligence), API keys, OAuth client secrets, tokens, session cookies.
- The contents of
settings/override/and any file with database credentials. - Control panel passwords and dashboard tokens of Velocity.
- Private keys of certificates.
- Server addresses, database host names and internal paths of a real server.
- Two-step sign-in QR codes, secrets and recovery codes.
- Other people's data: see Privacy on camera.
Where secrets show up in Exponential
| Place | What it shows | What to do | Source |
|---|---|---|---|
The summary of exp:install | The administrator password, twice | Cut or blur it; change the password after recording | The console install |
var/log/initial-admin-password | The generated password | Never open it on camera; delete it after the first sign-in | The default administrator password |
--password=, --db-password= on the command line | Passwords in the terminal and its history | Use EXP_INSTALL_DB_PASSWORD for the database; clear the history | Install in one command |
settings/override/site.ini.append.php | Database settings | Never open it on camera | Live demo safety |
settings/override/expai.ini.append.php | The provider key of Exponential Intelligence | Never open it; revoke the key after recording | Exponential Intelligence |
Velocity control panel sign-in, qbixctl panel:password --generate | The panel password | Set it off camera | Velocity control panel |
A dashboard address with ?token= | The dashboard token | Do not show the address bar | Velocity control panel |
Two-step sign-in setup (/user2fa/setup) | The QR code and secret; recovery codes | Never finish the setup on camera | Two-step sign-in |
| Setup > System information | Paths, host names, database details | Show the top only, or blur | System information |
| Setup > Log files with Show unmasked | E-mail and IP addresses, secrets as written | Never switch it on while recording | Log viewer |
| Error pages and terminal errors | Paths, sometimes settings | Read before you show | Live demo safety |
Prepare the machine
[ ] A demo installation that holds no real secret: its own passwords, a key made only for the recording
[ ] A separate browser profile: no saved passwords, no autocomplete, bookmarks bar hidden
[ ] One window captured, never the whole screen
[ ] Notifications off: system, chat, e-mail, phone
[ ] Terminal: large font, a prompt without real host or user names, history cleared or off for the session
[ ] Password manager locked; sign in before recording, not during
[ ] Desktop and file manager: no file names with customers or projectsDuring recording
- If a sign-in form appears, pause the recording or the screen share, type, resume.
- Show documentation pages instead of settings files: they explain the same thing and contain no secrets.
- Before you show an error page or a long terminal output, read it.
- Keep the address bar out of the frame when an address carries a token.
If something leaks
| What leaked | Do at once | Then |
|---|---|---|
| A password | Change it | Sign out other sessions |
| A provider or API key | Revoke it at the provider | Create a new key; check the provider's usage for misuse |
| The control panel password or dashboard token | Set a new password; changing it ends every session | Check the panel's sign-ins |
| A two-step secret or recovery code | Set up two-step sign-in again for that account | |
| A real server's address or path | Tell the server's owner | Review what is exposed |
| A recording with any of the above | Do not publish it, or take it down | Edit the part out, or record again |
Blurring after the fact helps viewers who come later; it does not help against people who already saw or downloaded
the original. Treat a secret that was on screen as burned. If you find that a secret leaks because of a flaw in the
software, report it privately to [email protected], as SECURITY.md asks, and do not publish details until a fix
is out.
Related pages
- Live demo safety
- Privacy on camera
- Live stream guide
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.