Loading...
A Neovim plugin that hides secrets in config files while you share your screen, with extmarks, without touching the file.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&s=64){kind=small}
git clone https://github.com/zeybek/camouflage.nvim.gitcamouflage.nvim hides secrets in config files while you share your screen. It draws stars, dots or scrambled text over the values in .env, .json, .yaml, .toml, .properties, .netrc, .xml, .http, Terraform and HCL (.tf, .tfvars, .hcl) and Dockerfiles, using Neovim extmarks, so the file itself never changes.
I wrote it after one too many pair-programming sessions where a .env scrolled past on a shared screen. Masking the file on disk was never an option, and remembering to close it never worked, so the fix had to be visual and automatic.
It understands nested keys like database.connection.password in JSON, YAML and XML, and masks strings, numbers and booleans alike. You can reveal a value for a moment, or auto-reveal the line under the cursor as you move. :CamouflageYank copies the real value on purpose, with a confirm prompt and a timed clipboard clear, because yy on a masked line still copies the real text. A workspace audit lists every supported file in the quickfix window without showing a single value, and a small offline check flags weak secrets, placeholders, repeated values and low-entropy tokens, reads the exp claim out of JWTs to say "expires in 2h", and can check passwords against Have I Been Pwned if you opt in. Parsing goes through TreeSitter where it can, Telescope and Snacks previews get masked too, config reloads live, and there's an API to register your own parsers and checks.
It's a visual layer. It protects against shoulder-surfing, screen sharing, screenshots and demos, and against nothing else. Grep results, LSP servers, completion sources, AI assistants, :%print, :w and the clipboard registers all see the real text, because it's still there under the mask. Per-repo .camouflage.yaml files are read as data and never executed, and if you don't trust the repos you open, project_config.secure = true puts that file behind Neovim's trust prompt.
With lazy.nvim:
{
"zeybek/camouflage.nvim",
Open a .env and the values are stars. :CamouflageToggle turns it off, :CamouflageReveal shows the current line. Everything else, the audit, the checks, the rule-based policy for which paths and keys to mask, is in the README. Needs Neovim 0.9 or newer, 0.10 for the network checks.