API Key Redactor on Screenshot Pages

WHAT IT DOES

This script automatically scans any page for API keys, tokens, and secrets using configurable regex patterns, then redacts them to prevent accidental exposure in screenshots or recordings. It detects keys from OpenAI, Google, GitHub, Stripe, AWS, and generic tokens, replacing them with masked placeholders like "sk-••••xxxx" or a simple lock icon. A floating badge shows the count of redacted items, and you can toggle redaction visibility, copy original values, or clear all redactions with one click. Perfect for developers sharing code snippets, documentation, or troubleshooting screenshots.

WHERE IT RUNS

The script works on any page with text content—documentation sites, code repositories, API dashboards, logs, configuration files, and any page displaying potential secrets. It scans text nodes across the entire page, excluding input fields and code editors, and works on any website regardless of structure.

HOW TO USE

After installation, the script automatically scans and redacts API keys on page load. A badge appears showing how many items were redacted. Open the panel to configure settings: choose redaction style (masked or removed), adjust mask length (2-10 characters), toggle patterns on or off, and set badge position. Use "Scan & Redact Now" to manually trigger a scan. The "Copy Original Values" button copies all redacted keys to your clipboard (useful for recovery), "Toggle Redaction" shows/hides redactions, and "Clear Redactions" reverts the page to its original state. Hover over a redacted item to see the original value if "Show original on hover" is enabled.

TECHNICAL MECHANISM

The script uses a multi-stage scanning and redaction pipeline. First, it walks the DOM using a TreeWalker to find all text nodes, excluding script, style, and form input elements. Second, it applies enabled regex patterns to each text node, detecting matches with global flags to find all occurrences. Third, it builds a list of replacements sorted by position (descending) to avoid offset issues during replacement. Fourth, it generates redacted HTML for each match: for mask style, it preserves the first few characters and appends dots plus the last N characters; for remove style, it replaces with a lock emoji. Fifth, it replaces the original text nodes with document fragments containing the redacted spans. Sixth, it tracks all redacted items in memory with their original values, types, and DOM references. Seventh, it updates the floating badge with the count and provides panel controls for visibility toggling and clipboard export.

THE PANEL

The settings panel is fully draggable and can be positioned anywhere on your screen. It automatically snaps to the nearest edge when released, keeping your workspace organized. The panel can be collapsed to a small bubble showing only a gear icon, and restored with a single click. Its position is remembered across page reloads using GM_setValue. The panel also responds to the Escape key, which instantly hides it until you click the bubble again. All settings are saved immediately when changed and persist across browser sessions.

PLEASE NOTE

This script requires the free BotGentz extension to run. Redaction is performed client-side and does not send any data to external servers. The original values remain accessible through the "Copy Original Values" function and hover tooltip (if enabled). Always verify that sensitive keys are properly redacted before sharing screenshots. The script is not a replacement for secure credential management. All processing happens locally in your browser and never leaves your device.