Meeting Mode: How SecureLint Blurs Secrets the Second a Video Call Starts

You are sharing your screen on a Google Meet call, walking a new client through your dashboard, when a teammate spots something in the background: a long string of characters in an open tab. An AWS access key. Or a Stripe secret. Or a database connection string. It happens in seconds and you don't notice until someone asks, “is that your production key?”

SecureLint Meeting Mode exists precisely to close this gap. The moment the extension detects an active video call, it automatically blurs every sensitive credential it can find across all your open browser tabs — before a single pixel reaches the screen share stream. When the meeting ends, the blur lifts. No manual toggles, no closing tabs, no pre-call checklists.

What is SecureLint Meeting Mode?

Meeting Mode is SecureLint's automatic privacy layer that activates in response to an active video call. Unlike generic screen-sharing tips that ask you to manually close sensitive tabs before each call, Meeting Mode works the other way round: it masks data in place so you never have to choose between having the right tools open and keeping secrets off the screen.

When a call is detected, SecureLint overlays a blur on every DOM element whose visible text matches a known credential pattern — API keys, database passwords, tokens, and card numbers. The blur is applied client-side, inside the browser extension, with zero network round-trips. From the outside, your screen share shows blurred placeholders where secrets would be. Your own view is identical to your colleagues' — a constant reminder that the masking is active.

How SecureLint detects an active video call

SecureLint watches two independent signals inside the browser extension manifest, both of which stay entirely on-device:

1. Tab URL and title patterns — SecureLint maintains a fast regex index of known meeting URLs: meet.google.com/*, zoom.us/wc/*, teams.microsoft.com/*, app.webex.com/*, *.jitsi.org/*, and several others. Any tab matching these patterns flips Meeting Mode on within milliseconds.
2. Camera and microphone permission grants— A video call almost always requests camera and microphone access. SecureLint listens to the browser's permissions API. When a page is granted both camera and microphone access, Meeting Mode activates for that session even if the URL is not on the known list — for example, a custom enterprise video tool on a private subdomain.

What gets blurred during a meeting

SecureLint's detection engine covers more than 100 credential patterns across every major cloud and SaaS platform:

• Cloud provider keys — AWS Access Keys (AKIA…), AWS Secret Access Keys, GCP service account JSON, Azure client secrets
• Source control tokens — GitHub personal access tokens (ghp_…), GitLab personal tokens, Bitbucket app passwords
• Payment gateway secrets — Stripe live secret keys (sk_live_…), Stripe restricted keys, Razorpay key_secret values
• AI platform keys — OpenAI API keys (sk-proj-…), Anthropic API keys, Cohere keys
• Project management tokens — Jira API tokens, Atlassian OAuth secrets, Linear API keys, Notion integration tokens
• Database credentials — PostgreSQL and MySQL connection strings, MongoDB Atlas URIs, Redis AUTH strings
• Auth tokens — JWT tokens (three dot-separated base64 segments), OAuth access and refresh tokens
• Private keys — PEM-encoded RSA and ECDSA private keys, SSH private key blocks
• Payment card numbers — Luhn-validated 13–19 digit card numbers not inside a type="password" field

Patterns are matched against the rendered text content of every visible element on the page as well as input field values that are not of type password. The match runs against the DOM, not raw HTTP responses, so it works on single-page apps, dashboards loaded via AJAX, and server-side-rendered pages alike.

How the blur engine works technically

When Meeting Mode activates, SecureLint performs the following steps on each open tab:

1. DOM traversal — A content script walks the live DOM collecting all text nodes and input values. It skips script, style, noscript, and template elements.
2. Pattern matching — Each text node is tested against a compiled regex set. The engine is greedy: it matches the longest possible token that looks like a credential and ignores surrounding prose.
3. Overlay injection — Matched nodes receive a data-sl-masked attribute and SecureLint injects a ::before pseudo-element via a dynamically inserted stylesheet that renders a solid blur overlay on top of the matched text. The underlying DOM text is unchanged — only the visual presentation is altered.
4. Mutation observer — A MutationObserver watches for new content added to the DOM (lazy-loaded panels, WebSocket pushes) and re-runs the pattern matcher on added nodes, ensuring secrets that appear after page load are also blurred.
5. Cleanup on call end — When the meeting tab closes or permissions are revoked, SecureLint removes the injected stylesheet and clears all data-sl-masked attributes, restoring the page to its original state.

Setting up Meeting Mode in SecureLint

Meeting Mode requires no configuration. It is enabled by default after you install the SecureLint Chrome extension:

For enterprise deployments, IT admins can enforce Meeting Mode as a non-overrideable policy via the SecureLint admin console, preventing employees from accidentally disabling it before a call.

When the blur lifts automatically

SecureLint lifts the blur when any of the following is true:

• The meeting tab (Google Meet, Zoom, Teams) is closed.
• The meeting tab navigates away from the call URL (e.g., back to the Google Meet home screen).
• The page that held camera/microphone permission is unloaded or the permissions are revoked.
• You manually click Pause Meeting Mode in the SecureLint panel (the blur lifts for 10 minutes, then re-arms automatically).

The state machine is evaluated every 3 seconds in the background service worker, so the maximum lag between a call ending and the blur lifting is under 5 seconds in practice.

Meeting Mode vs manually hiding tabs

The conventional advice is: close sensitive tabs before a call. That advice works until you need those tabs open to do your job — a developer on a support call needs the production console open, a founder doing a live demo needs the real Stripe dashboard.

Manual tab management also fails in two predictable ways:

1. The unexpected call — Someone shares a Slack Huddle link mid-conversation and you join before you have time to sweep your tabs.
2. New content after the call starts— A CI/CD system pushes a deployment key to a dashboard tab that was already open and “safe” when you started sharing.

Meeting Mode handles both. It is always watching, it activates instantly, and it covers dynamic content that appears after the call begins. You keep every tab open that you need, and SecureLint makes sure none of the credentials in them reach the screen share.