Yesterday, on a Zoom meeting, I watched a senior engineer from a company you’d definitely recognize (FANG) accidentally leaked her AWS credentials while sharing her screen.
No one on the call said anything.
She needed help with debugging a tiny bug.
The screen flicked over to her browser, and specifically - AWS console — and right there, in plain text, was a long, juicy AWS secret (❗️).
The kind of secrets you hope never leaves your local machine. It lasted maybe 3 seconds, but the meeting was recorded.
We’ve normalized zoom/google/whatever meetings and screen sharing, but we haven’t adapted our tools — or habits — to protect sensitive data in real-time.
<h2>This Happens Way More Than We Think</h2>
As developers, we move fast. Our tools are always open:
<ul>
<li>Dashboards full of internal data</li>
<li><code>.env</code> files</li>
<li>Devtools showing API responses</li>
<li>PIIs all over our browser</li>
<li>Debug consoles</li>
</ul>
Secrets don’t live in just your code — they’re in your browser, your extensions, your tabs, your terminal. When you screen share, you’re not just sharing your work — you’re potentially leaking everything under the hood.
<h2>The Cost of a 3-Second Mistake</h2>
Screens are recorded. Calls are uploaded. Interns and clients and strangers see your screen.
That one token? Maybe it had admin permissions. Maybe it let someone spin up $50k in EC2s. Maybe it wasn’t rotated fast enough.
I’ve seen this happen multiple times in the last year. I’ve also… done it myself.
<h2>So I Built a Fix</h2>
<img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zn4nv78g6wmy6t0ankoi.png" alt="Entropy Demo Screenshot">
(Entropy Demo screenshot)
This problem kept nagging at me, so I built something to solve it.
It’s called <a href="http://entropysec.io/?utm_source=devto-blog-1&amp;utm_medium=devto&amp;utm_campaign=blog" target="_blank" rel="noopener nofollow">Entropy</a> — a Chrome extension that detects and redacts secrets and PII in real time, right inside your browser.
<ul>
<li>✅ Detects API keys, AWS secrets, emails, tokens, etc.</li>
<li>✅ Redacts data before it shows up on screen</li>
<li>✅ Customizable rules</li>
<li>✅ Fast, private, local</li>
</ul>
Whether you’re on a sales call, a Twitch stream, or a demo for your CTO — you shouldn’t have to worry about what’s lurking in your devtools.
<h2>Let’s Fix This for Everyone</h2>
If you’ve ever leaked a secret — or almost did — you’re not alone. 
I’d love to hear your stories, feedback, or ideas.
Would this be useful in your team? 
Try <a href="http://entropysec.io/?utm_source=devto-blog-1&amp;utm_medium=devto&amp;utm_campaign=blog" target="_blank" rel="noopener nofollow">Entropy</a> and let me know what you think.
<a href="http://Entropysec.io" target="_blank" rel="noopener nofollow">Entropysec.io</a>

A dedicated squad for devtools: discussions, recommendations and questions. 

Dev Tools

A senior engineer accidentally exposed her AWS credentials during a Zoom meeting, highlighting the risks of screen sharing without adequate safeguards. The post discusses the widespread issue of accidentally sharing sensitive information and introduces Entropy, a Chrome extension that detects and redacts secrets and PII in real-time. Entropy aims to prevent such leaks by securing data during screen sharing and is customizable for different security needs.

She Shared Her Screen… and Her AWS Secret (Yes, she's a FANG)

this is nice considering it has free tier, but kind of surprised it has a subscription of 3.99, if it was lower i wouldn’t think of it really. I mean probably you’d never think hmm i have shared secret keys so much accidentally in a call maybe paying a $3.99 a month to avoid this is worth it.

how does it recognize the secret being a secret? also, when will there be a firefox plugin?

Sounds awesome, just installed it!

I prefer to use firefox to deal with important things, and use firefox-developer-edition to share my screen or develope webpage,that two app really look diffrent and don’t make anybody feel sus, eg: open a chrome incognito window. This is my simple solution.

What’s worse than sharing your secret in a call? Feeling safe, doing so.
If the website showcase is accurate, it only blurs the secrets. Blurring of plain text is easily reversed, if you have the incentive to do so.
If there is no option to fully hide the secrets instead (I didn’t check further than the landing page), this is just utter garbage.
Security is no playground for amateurs.