There is no faster leak in streaming than the autofill dropdown. You type two letters into a search bar — meaning to look up a player name — and your browser helpfully suggests your email address, your home address, your saved username for a site you visited once in 2023. It renders on screen in milliseconds, on top of whatever you're doing.
By the time you react, it's clipped.
Why Credential Surfaces Are Different
Most leaks in this series are about windows you opened. Autofill leaks are about windows you didn't open — surfaces rendered by the browser, the OS, or a password manager extension, triggered by innocent input:
- Typing in a search or login field summons saved entries.
- Focus on a checkout field summons saved card UI.
- A password manager's "unlock" prompt appears when the browser restarts mid-stream.
- Windows' own credential dialog pops for a network share, a printer, a mapped drive.
These surfaces don't wait for you to make a mistake. They volunteer.
The Streamer's Special Risk Profile
Gamers stack risk factors that normal users don't:
- Long sessions. Eight hours of stream means eight hours of exposure time.
- Browser-heavy workflows. Checking stats, clips, patch notes, Discord web, wikis — constant typing into fields.
- Frequent restarts and crashes. Browser crash mid-stream → session restore → password manager unlock prompt on screen.
- Alt-tab reflexes. The same reflex that exposes window titles also lands your focus on the wrong field at the wrong time.
What Helps (Partially)
- Disabling autofill for addresses and payment methods. Good hygiene, but it degrades daily browsing and most people re-enable it within a month.
- Separate browser profiles for streaming. Solid, until you stream from a different machine or a profile syncs.
- Password manager settings that suppress in-field autofill. Reduces frequency, doesn't eliminate prompts.
Every one of these is behavioral. Every one decays.
The Architectural Answer
The surfaces that matter share one trait: they belong to apps you want protected anyway. Your browser is already on the cloak list. Your password manager app is a designated protected window. When those apps and their child surfaces are excluded at the compositor level, the autofill dropdown renders for you and is absent from the capture stream — because the capture stream never receives the browser's frame at all.
This is Layer 1 doing its one job: making the question "what's on screen right now?" irrelevant to the question "what does the audience see?"
The Bottom Line
You cannot type carefully enough to outrun an autocomplete engine. It is faster than your reaction time by design. Put the browser and the vault below the capture line, and let the dropdowns render all they want — for an audience of one.
NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.
