How SecureLint Automatically Masks API Keys in Every Text Editor, Textarea & Input

You paste an AWS access key into a Notion doc to share with a teammate. You type a Stripe secret key into a Jira ticket description. You copy a database connection string into a Slack message. Each of these actions takes less than five seconds — and each one can cause a breach that takes months to contain.

SecureLint's automatic credential masking catches these moments the instant they happen. The moment a credential pattern appears in any text editor, textarea, or input field in your browser, SecureLint overlays it with a masked placeholder — without interrupting your workflow, and without sending a single byte of your data anywhere.

The accidental credential exposure problem

Accidental credential exposure is one of the most common causes of cloud breaches. The patterns are consistent:

• A developer pastes an API key into a team chat to quickly share it, forgetting the channel is public or logged
• A secret is left in a Notion page, a Confluence doc, or a Linear issue — tools that are often shared with contractors or broadly visible across the organisation
• A connection string is typed into a web-based terminal or cloud shell that logs session output
• A credential is accidentally included in a commit message or PR description in the GitHub web editor

Traditional secret scanning tools catch credentials in code repositories — but they only fire after a commit, and they have no visibility into your browser-based collaboration tools at all. SecureLint fills this gap by operating at the browser layer, where the exposure actually happens.

How SecureLint credential masking works

SecureLint injects a lightweight content script into every page you visit. The script does three things continuously:

1. Input monitoring — A MutationObserver and input event listeners watch every <textarea>, contenteditable element, and <input type="text"> on the page. When text changes, the new content is passed to the pattern engine.
2. Pattern matching — The content is tested against a compiled set of over 100 credential regexes. Matching runs locally inside the extension sandbox — no network call is made at any point.
3. Overlay injection — When a match is found, SecureLint injects a visual mask overlay on the matched text. The underlying value in the DOM is not altered — only the rendered display is changed. This ensures form submission, copy-paste, and developer tools still see the real value when needed.

Supported editors and input surfaces

SecureLint masks credentials across every standard web input surface, including:

• Web-based code editors — VS Code for the Web (vscode.dev), GitHub.dev, CodeSandbox, StackBlitz, Replit, Google Cloud Shell Editor
• Project management tools — Jira issue descriptions, Linear issue bodies, Notion pages, Confluence wiki pages, Asana task descriptions
• Communication tools — Slack message composer, Microsoft Teams message input, Discord message box
• Version control web UIs — GitHub PR descriptions, commit messages (web editor), GitLab MR descriptions, Bitbucket PR bodies
• Any standard HTML textarea — If the element is a <textarea> or a contenteditable div, SecureLint watches it

Credential patterns detected (100+)

SecureLint's detection library covers the most commonly leaked credential types:

• AWS — Access Key IDs (AKIA…), Secret Access Keys, session tokens
• GCP — Service account JSON private keys, API key strings
• Azure — Client secrets, connection strings, SAS tokens
• GitHub — Personal access tokens (ghp_…, github_pat_…), OAuth tokens, fine-grained PATs
• GitLab — Personal tokens (glpat-…), project tokens, deploy tokens
• Stripe — Live secret keys (sk_live_…), restricted keys, webhook secrets
• OpenAI — API keys (sk-proj-…, sk-…)
• Anthropic / Claude — API keys (sk-ant-…)
• Razorpay — Key secret values, webhook signing secrets
• Jira / Atlassian — API tokens, OAuth secrets
• Database credentials — PostgreSQL and MySQL URLs (postgres://user:pass@host), MongoDB Atlas SRV URIs, Redis AUTH strings
• JWT tokens — Three-segment base64 tokens (header.payload.signature)
• SSH private keys — PEM blocks (-----BEGIN RSA PRIVATE KEY-----)
• Generic high-entropy strings — Long base64 or hex strings in key-value contexts that exceed the entropy threshold for random secrets

Setting up auto-masking in SecureLint