Redaction

Real apps show real data. DemoTake protects it in three layers: fields you type secrets into are never logged, Secret Guard finds common secrets on screen and blurs them, and you can draw a redaction over anything else. All of it is applied when DemoTake renders. The recording itself stays unchanged, so a redaction can always be moved or removed later.

#Draw a redaction

The box is placed on the recorded content, not on the output frame, so it stays over the right spot when the camera zooms or when you export 9:16 instead of 16:9.

#Styles and scope

A redaction has one of three styles: blur (the default), pixelate or solid (an opaque box). Boxes you draw on the Mac use blur. In DemoTake Web, select a redaction to switch it between Blur, Pixelate and Solid.

It can cover:

• a scene: what you get when you draw one;
• the whole take: every scene, for something that is always on screen, like an account name in a sidebar;
• a time range within a scene.

Whole-take and time-range redactions are made with the MCP tools below (DemoTake Web shows whole-take ones as Every scene).

#Secure fields are masked automatically

Passwords never make it into a take:

• When you record by hand, keystrokes typed while macOS secure input is on (every password field) are never recorded. The take only notes that something secret was typed.
• When an agent types through DemoTake, secure fields are detected automatically, and anything typed with secure: true is treated as a secret too. The text is never logged.
• Typing that DemoTake recognizes as a secret or as personal data, such as an email address, is marked for masking too.

When DemoTake knows where such a field is on screen, it also blurs it in renders, from the moment it is touched to the end of the scene. The Redactions group says how many, for example "2 typed fields masked automatically". To mask any other event, select it and turn on Mask in renders, or right-click it and choose Mask.

#Secret Guard

Secret Guard reads the text on screen and recognizes common secrets: email addresses, API keys and access tokens, card numbers, one-time codes next to words like "code", phone numbers and bank account numbers.

• In your takes. With Auto-redact sensitive data on in Settings › Privacy (it is on by default), DemoTake checks frames from each scene after recording and adds a blur over what it finds. These redactions show a shield icon and are named after what was found, such as "Email address", with the second of the frame it was found in. Secret Guard samples frames rather than reading every one, so still check the contact sheet before you export. Review in Large View (in the Redactions group) shows a scene's frame large, as exported: pick each frame Secret Guard read, or the playhead's, from the frame menu; turn off a suggestion it got wrong, fix its size, or click a line of text to hide it. Zoom in to check small text (pinch, ⌘-scroll or the zoom buttons, up to 800%); everything works the same while zoomed in, and scrolling or Space-drag moves around. Redactions of the whole take show there too, locked, and a redaction for part of a scene is drawn only in frames inside its time.
• In agent snapshots. Snapshots returned to agents have detected secrets blurred before they leave DemoTake, and UI text returned by observe_state has secrets replaced.
• In AI requests. Text sent to DemoTake AI or your own AI provider key is redacted first. Password and secure-input fields are never sent.

#Remove a redaction

Click the trash button next to it in the Redactions group (Delete Redaction). In DemoTake Web you can also select it and press Delete. Like every edit, it can be undone with ⌘Z.

#For agents: edit_redact

edit_redact adds a redaction. region is normalized to the recorded content (0 to 1, top-left origin). Omit scene for the whole take; omit start and end for the whole scene. style is blur (default), pixelate or solid:

{
  "take_id": "<take id>",
  "scene": "Account settings",
  "region": { "x": 0.62, "y": 0.04, "width": 0.3, "height": 0.1 },
  "start": 1.5,
  "end": 9.0,
  "style": "pixelate",
  "reason": "Customer name"
}

remove_redaction {id} in edit_apply removes one. When an agent drives the app with its own tools, it should log secret input with take_log_event and redact: true, and never put a password in text.

#Where to go next

• Privacy and data: what stays on your Mac.
• Framing and Fit to Content: the contact sheet, for a last check before export.
• Blur sensitive data in screen recordings: a walkthrough.