Yes. Screenshots, GIFs and screen recordings in docs regularly show API tokens, email addresses, internal hostnames, account identifiers and real customer records. Once published, they are copied and indexed. Capture from a clean demo environment with fake data, and review every image before it ships.
What ends up in a screenshot
The interface shows more than the author is thinking about. Common leaks include:
- An API key or token on a settings page, even partly masked.
- The author's real email address, name or avatar in a corner menu.
- Internal hostnames, project names or ticket numbers in a browser tab or address bar.
- Customer names and order details in a table that was only meant to show layout.
- Cloud account or tenant identifiers in a URL or a footer.
- Notifications, bookmarks or other tabs visible in a full screen capture.
Screen recordings add more: autofill suggestions, typed passwords briefly visible, terminal history scrolling past.
Why it is hard to undo
Images spread. A screenshot copied into a slide, a forum or a search index is beyond your control within days. If a token appeared in it, deleting the page does not remove the exposure. Treat the credential as compromised and rotate it. The ordering of those steps is in leaked secret response: order of steps.
Also remember that blurring is fragile. Light blur and pixelation can sometimes be partly reversed, and layers left in an editable image file can be opened. Remove content properly before export.
A better capture process
| Step | Why |
|---|---|
| Use a dedicated demo tenant with synthetic data | Nothing real to leak |
| Create demo accounts with an obviously fake email at a reserved domain | The corner menu is safe |
| Use a clean browser profile with no extensions, bookmarks or autofill | Nothing leaks from the chrome around the page |
| Issue short lived demo tokens that you revoke after the shoot | A visible token is already dead |
| Crop to the relevant area | Less surface to review |
| Export flattened images, not layered files | Removed content stays removed |
| Review at full size before publishing | Small text hides in corners |
Review before publishing
- Open each image at full size and scan the edges, the address bar and the tab strip.
- Zoom into tables and read the values, not just the shape.
- For recordings, scrub through frame by frame around any sign in or settings screen.
- Ask a second person to look, since the author's eyes skip what they know.
- Keep the source capture and a note of the demo environment used, so updates are consistent.
Prefer text where text works
A code block with a placeholder is copyable, searchable and cannot leak what it does not contain. Use screenshots for layout and navigation, and text for values. See also how should docs show api keys in code samples.
Safeguard's dependency scanning and SBOM generation cover the sample projects behind your docs, and policy gates can hold risky changes in review. The free scan is at https://gold.safeguard.sh/scan.
Quick check
Is blurring a token in a screenshot enough?
It is risky. Remove the content before export, and rotate any credential that was ever visible.
What is the safest data to show in docs images?
Synthetic data from a dedicated demo environment, with demo credentials that are revoked after capture.
Last reviewed: 19 October 2026.
