Your camera roll is part of your developer threat model.

The artifact outside the usual checklist

A temporary debugging aid can become a durable data copy.

Developers protect source repositories, CI secrets, cloud consoles, and password managers. A copy of the same data can still escape that lifecycle: a terminal screenshot, a cloud-dashboard capture, a support image, or a photo of recovery material.

Deleting the original chat, ticket, or note does not remove a separate image saved to Photos. With iCloud Photos enabled, Apple says changes to the library appear across devices signed in to the same Apple Account. The practical rule is simple: treat every screenshot as a data copy with an owner, a purpose, and a deletion condition.

What to audit

Start with the Screenshots collection, then review other text-heavy photos. Apple says Photos can search text recognized inside images, so try a remembered service name, environment label, email address, or surrounding word. Search is a useful lead, not proof that the library is clean.

• Terminal output: environment variables, tokens, hostnames, internal paths, and command history.
• Cloud dashboards: API keys, webhook secrets, project IDs, account emails, and billing details.
• Recovery setup: backup codes, seed phrases, QR codes, and device-enrollment values.
• Support and debug logs: request headers, session details, user identifiers, and verbose error output.
• Identity and payment screens: verification documents, invoices, bank details, and card information.
• Physical access details: Wi-Fi credentials, door codes, and device-setup labels.

Do not rely only on filenames or dates. The risky content is usually visible text inside the image, and an old screenshot can still contain a live secret.

Deleting the message is not deleting the copy.

Cleaning up the original conversation and cleaning up Photos are separate actions. The reverse matters even more: deleting the image does not revoke a credential that another person or service may already have seen.

GitHub's secret-security guidance is explicit that deleting leaked data is insufficient; the affected credential must be revoked or replaced. Apply that principle whether the exposure happened in a repository, a support ticket, or a screenshot.

Use a safer remediation order.

1. Confirm a recovery path. Make sure you can create and store a safe replacement without locking yourself or a production system out.
2. Rotate or revoke the exposed credential. Use the official controls for the service that issued it.
3. Update legitimate dependencies. Replace the old value in the applications, automations, or people that still require access.
4. Redact if context must be kept. Create a safe copy and inspect it at full size before sharing or retaining it.
5. Delete the original deliberately. Apple says deleted photos normally remain in Recently Deleted for 30 days unless permanently removed sooner.

Rotation comes before cosmetic cleanup because deletion is not revocation. If the screenshot left your control, respond to the credential exposure even if you later remove every local copy.

Local scanning is a tradeoff, not magic.

Manually reviewing thousands of images is slow, so OCR and pattern matching can help with the first pass. Apple's Vision framework performs text recognition on the device. Keeping that analysis local avoids sending a private photo library or extracted text to another scanning service.

OCR can still miss small, blurred, cropped, low-contrast, or unusually formatted text. Pattern matching can flag harmless strings that resemble keys or account numbers. A useful scanner should therefore show possible findings, explain why they were flagged, and leave deletion, redaction, and credential response to a person.

Make screenshot hygiene routine.

• Review the Screenshots collection weekly or after a sensitive support session.
• Rotate credentials promptly when a screenshot leaves your control.
• Avoid capturing secrets when a redacted example or copied non-sensitive excerpt will do.
• Use test credentials in demos and documentation.
• Include photo-library cleanup in device-transfer and offboarding checklists.

Where SecretScan fits

I built SecretScan to automate this local first pass on iPhone and iPad. It uses Apple's Vision framework for on-device OCR and presents results as possible findings for review. Photos, extracted OCR text, and finding details are not uploaded to SecretScan servers. The screenshot scan is free.

It cannot guarantee that every secret will be found, and a match does not prove exposure. It also cannot rotate or revoke a credential. You can use the checklist above without the app.