Your screenshots leak API keys. Ours catch them.
Frayo flags keys, tokens, emails and card numbers in your captures, on your Mac. It is best effort, not a guarantee.
Everyone has done it. You screenshot a terminal to show a bug, post it in a ticket, and three days later someone notices the bearer token on line 12. Now you are rotating a key.
Screenshots are the one place where secrets slip past every scanner. Your repo has a pre-commit hook. Your CI has secret scanning. A PNG has nothing.
What Frayo does
After each capture, Frayo reads the text in the image. This is the same on-device text recognition it already uses for search. Then it runs that text through a set of detectors:
- A bundled rule set from the open-source gitleaks project. It covers many cloud keys, API tokens and private keys.
- Email addresses.
- Card numbers. A run of digits only counts if it passes the Luhn checksum, so order numbers do not set it off.
- Your own patterns, added as regular expressions in Settings → Privacy.
If anything matches, the capture gets a small orange key badge. It shows on the floating thumbnail, on the Library tile and in the menu. Hover it and it says how many possible secrets it found.
One click to cover them
Next to the dot is a Redact button. Click it and Frayo paints solid black bars over every flagged spot, slightly larger than the text so no glyph edge peeks out. The bars are written into the file at full resolution. This is not a blur, and it is not a layer you can peel off. The pixels are gone.
You get a few seconds to Undo. The original is held in memory for that long and never written to disk. After that, redaction is permanent, so look at the result.
The honest part
This is best effort. We say so in Settings, and we will say so here.
- It reads text with OCR. A secret that OCR cannot read, because it is small, blurry or in a strange font, will not be found.
- Rules match shapes, not truth. It will flag a fake key in a tutorial, and it can miss a real key in a format nobody wrote a rule for.
- A broad "generic key" rule exists to catch odd cases. It is noisy, so it only claims text that no specific rule matched.
- It does not see what you did not capture, and it does not know what is sensitive in your company. That is what custom patterns are for.
So the badge is a nudge, not a certificate. A capture with no badge is not "clean". Look at it before you share it. The point is that an orange key badge catches the mistake you were about to make while you were tired.
On your Mac, only
The whole thing is local. No text or image is sent anywhere to be checked. There is no cloud service that sees your keys in order to tell you they are keys. That matters here more than anywhere: a secret scanner that uploads your secrets would be a joke.
Custom patterns are guarded too. A pattern that is not valid, or that would take too long to run on a screenshot, is refused when you add it, and each scan has a short time limit. A bad pattern cannot freeze the app.
Try it
Make a capture of a terminal that shows an environment variable. Look for the dot. Click Redact. Check the file in Finder.
Then add one pattern for your own tokens, such as acme_[a-z0-9]{32}, and capture again.
You can turn detection off in Settings → Privacy if you prefer. It is on by default, because the mistake is cheap to catch and expensive to make.