Metadata risks when posting code screenshots
Developers post screenshots constantly — a terminal error in a bug report, an IDE window in a README, a stack trace in a forum thread. It feels like the safest kind of image to share: no faces, no location tag, just code. But the image file itself can still carry hidden data, and the frame around your code can reveal more than you meant to.
What rides along in the file
A screenshot is still an image file, and image files can carry metadata — the same kind that hides in photos. Depending on the tool that captured it, that can include the software that took the screenshot, the OS and device, a timestamp, and sometimes editing history if you cropped or annotated it afterward. On a phone screenshot, some of that metadata can even carry GPS if location tagging is on for screenshots on that device. None of it shows up when you look at the picture — it's inside the file, not on the screen.
What's actually visible in the frame
The bigger risk with code screenshots usually isn't hidden metadata — it's what's plainly visible but easy to miss while cropping fast: your OS username in the file path, a hostname or internal server address in a terminal prompt, an API key or token printed in a debug log, a browser tab or notification banner caught in the background, or a file path that reveals your employer's internal project structure. None of that is metadata scrub can find or strip — it's pixels, and the only fix is looking carefully and cropping before you post.
What about the code itself
If you're pasting code as text rather than a screenshot, there's a separate risk: some AI coding tools and browser copy actions insert invisible characters — zero-width spaces or similar — into text you copy out. They don't change how the code reads, but they can survive a copy-paste into a README, a commit message, or a forum post. See our zero-width space explainer for how to catch those in text you're about to paste.
What scrub actually checks
For the image itself, scrub reads a screenshot locally and shows you any EXIF, XMP or appended data before you post it — then strips it losslessly if you want a clean copy. It won't redact anything visible in the frame; that part is still on you. The habit that actually works: crop tight, glance at every visible string for anything you wouldn't want public, then run the file through scrub before it goes into the README or the bug tracker.
The short version
A code screenshot can carry hidden file metadata and, more often, something more revealing sitting in plain sight in the frame. Check both — clean the metadata locally, and eyeball the pixels — before you post it. Get scrub free and check a screenshot in seconds.