How to Hide Your .env While You're Livestreaming

#extensions #livestreaming

Note: This article assumes basic knowledge of VSCode. This article was originally posted in the DEV general community.

Here's how to start using John Papa's VSCode extension Cloak to hide .env secrets, especially helpful when you're livestreaming!

Search 'Cloak' in VSCode extensions and install it.

Open up a .env file with your secrets in it. It should look something like this:

Open up your Command Palette and hit 'Cloak: Hide Secrets'

And there you have it! Your secrets are hidden! You can un-hide them by running the 'Cloak: Show Secrets' command.

Note: If you copy/paste, your secret will be visible in the file you pasted it in.

PS- many thanks to @nickytonline who pointed out the usefulness of this extension!

Discussion (9)

Meghan • Sep 20 '21

Nice find! I'm weary of an extension like this due to I'm not sure how VScode deals with updating extensions. This seems like a very big attack vector for sniffing secrets out of users' environments. But then again I suppose that's the case for all extensions..

Lucia Cerchie • Sep 20 '21

You're right! A good question for VSCode?

Nick Taylor • Sep 1 '21

Thanks for the shoutout Lucia! Love this extension!

Daryl Stark • Sep 9 '21

Good tip! Does this also work to hide variables during debug?

Lucia Cerchie • Sep 9 '21

What debugging UIs are you thinking of? I think keys would still show up on console.log, for example.

Daryl Stark • Sep 12 '21

I like to create a variable that contains the username and password for specific taka, but when the debugger stops at a breakpoint, that variable is visible at the left hand side in the Variable View.