Recording something real

A recording is a publishing format. Whatever was on screen ends up in a file that goes into a README, and a capture stores it as plain readable text. Two flags exist so that does not become a problem.

ttysvg record --sanitize --redact "sk-[A-Za-z0-9]+" --out demo.svg -- ./deploy

--sanitize

Handles the boring case with no regex. It rewrites your home directory to ~, and replaces your username and hostname with user and host. That alone covers most of what makes people delete a demo and record it again.

Its matching is case insensitive, because a tool will happily print your hostname with different capitalization than the environment variable holds.

--redact

Takes a regex and masks every match with *. It can be repeated.

--redact "sk-[A-Za-z0-9]+"        # OpenAI style keys
--redact "ghp_[A-Za-z0-9]+"       # GitHub tokens
--redact "Bearer [A-Za-z0-9._-]+" # authorization headers

In a tape

sanitize on
redact "sk-[A-Za-z0-9]+"
redact "ghp_[A-Za-z0-9]+"

When masking happens

Redaction runs the moment a frame is captured, before anything is written, so a masked secret is never in the SVG or the capture. It also covers the command line itself, which matters when the secret is an argument rather than output. Masking keeps the original character count, so the layout does not move.

Cleaning a capture after the fact

If you already have a capture that was recorded without it, the same flags work on render and will clean the output without re-running anything:

ttysvg render session.json --sanitize --redact "sk-[A-Za-z0-9]+"

That cleans the SVG it writes. It does not rewrite the capture file, so delete that too if it already holds something it should not.