Security principles
The protected preview is the product’s security boundary. Blotti reduces accidental disclosure risk; it does not make the source application safe to share and cannot control meeting participants or the meeting provider.
Content stays on the Mac
Screen frames, recognised text, and detected values are processed in memory. Version 1 has no capture-content API.
Share a distinct output
The processed Blotti Share window is separate from the display or window used as its source.
Masks are not translucent
Matched regions are covered by padded, opaque masks rendered into a newly created image.
Unsafe continuation stops
A raw or partially processed frame is never intentionally used as a fallback when protection fails.
Protection pipeline
ScreenCaptureKit supplies frames only after you select a source and start protection. A bounded, session-aware scheduler accepts one active frame and keeps only the newest pending frame so slow OCR cannot build an unbounded queue.
If a sensitive match cannot be mapped to precise substring geometry, Blotti masks the entire recognised observation. Raw frames are not intentionally published to the preview.
Custom regex hiders
A Pro custom hider is evaluated on device against each individual text region recognised by Vision. Every enabled rule is global and applies to every display or window capture; version 1 has no per-source or per-application rule scope. Blotti masks the complete regex match even when the pattern contains capture groups. If precise match geometry is unavailable, it masks the complete recognised region.
Rule names, patterns, case-sensitivity setting, and enabled state remain in the local app container. The optional tester evaluates sample text in memory and does not save it. There is no Blotti account, custom-rule backend, or cloud synchronisation.
Custom matching runs through a bounded, interruptible evaluator. If a pattern exceeds its safety budget or returns an unsafe result, Blotti discards partial custom matches and masks every Vision-recognised text region for the rest of that capture. The preview shows a generic warning, and capture continues under the stronger policy without exposing the pattern or text.
Permissions and operating-system boundaries
Blotti asks macOS for Screen & System Audio Recording permission because the operating system requires it before an app can capture another display or window. The permission can be revoked in System Settings at any time. Revocation prevents or interrupts capture.
Pro application and window blocking uses ScreenCaptureKit exclusion filters before frames enter the OCR pipeline. Excluding an application reveals whatever is behind it; it does not draw a permanent black rectangle over that screen location.
For display capture, the default-on system-notification control uses the same operating-system filter boundary to omit known macOS notification banners and Notification Center. Individual-window capture already omits unrelated system UI; alerts drawn inside the captured app remain part of its pixels.
Fail-closed behaviour
Blotti is designed to stop protected capture when continuing could publish an unsafe result, including:
- Capture or OCR failure, invalid frames, or a stalled safe-frame pipeline.
- Sleep, screen lock, relevant display changes, or interruption of Screen Recording permission.
- A blocked application launching or terminating while its exclusion policy is active.
- A protected macOS notification process launching or terminating during display capture.
- Stale application/window selections that can no longer be resolved safely.
- Loss of Pro access while a Pro-only protection policy is active.
A previously completed protected frame may remain visible after failure. Blotti does not substitute a raw or partially processed frame. The user must resolve the issue and explicitly restart protection.
Known limitations
- You must share only the window titled “Blotti Share — Share This Window”.
- Sharing the original source, Blotti controls, or the entire desktop bypasses protection.
- Fast-changing content can change between protected frames; keep reviewing the protected preview.
- Meeting services independently receive and process the protected output you choose to share.
- Performance varies with the Mac, display resolution, scaling, and amount of motion on screen.
Report a security or privacy issue
Use the support route for the current disclosure contact. Do not attach raw screen captures, credentials, payment information, tokens, or other secrets. Include the smallest safe reproduction and the macOS/Blotti versions when possible.