reel-check

name	reel-check
license	MIT
description	Use before a rendered reel, screen-recording, demo video, or GIF goes public (social, YouTube, a landing page) to catch identity and infrastructure leaks burned into the frames. Also use when the user asks "is this reel safe to post", "scrub this video", or before a video-publishing pipeline ships an MP4. For plain prose use plate; for repos use publish-readiness.

reel-check

The video equivalent of plate: the last look before a reel leaves the kitchen. A reel leaks differently from prose, so it needs its own pass. plate scrubs a block of text you can read and edit. A reel is a rendered MP4 you cannot grep, built from two surfaces that each leak:

1. The composition source - the text that gets burned into the frames.
2. The recording footage - whatever the screen capture happened to show.

You scrub the source, re-render or re-record, then verify the actual frames. The MP4 is the source of truth for what viewers see; source files can diverge from what got drawn.

What to scan

1. Composition source (on-screen text)

The captions, titles, and labels viewers read come from source files, not the video. Scan each:

• Cue / timeline JSON - captions[].text, titleCard.text, outroCard.text, any label fields.
• Composition file - index.html / *.tsx text nodes, data-* titles, alt text.
• Narration - SCRIPT.md, TTS input text, voiceover scripts (a leak spoken aloud is still a leak).
• Brand sheet - DESIGN.md and any generated metadata that ships with the project.

Leak types are the same as plate: internal hostnames and machine names, private IPs (RFC 1918), LAN URLs / ports / dashboards, absolute home paths (/home/<user>, /Users/<name>), non-public personal emails, and AI-authorship disclosure. See plate for the full list, the doc-range replacements (RFC 5737 192.0.2.x), and the writing conventions (no em dashes). A cold agent will not know the user's machine names - ask, or flag any internal-looking host for confirmation.

2. Recording footage (incidental leaks)

A screen recording shows far more than the text you authored. This is the surface plate has no concept of, and it is the one most often missed. Eyeball the footage for:

• Shell prompts - user@hostname in the terminal prompt, the path in pwd, a private IP in an ssh/curl command.
• Browser chrome - the URL bar, an internal dashboard, a private IP, logged-in account name or avatar.
• Notifications and chrome - toast popups, email/Slack/Discord previews with real names, the OS clock/menubar, other window titles.
• Anything the cursor or a zoom cue emphasizes - emphasis draws the eye straight to whatever is under it. Make sure that is not a leak.

A footage leak cannot be fixed by editing text. It needs a re-record, or a crop/blur/redaction over the region.

How to run it

# Mechanical floor over the SOURCE text. Does NOT see the footage or the MP4.
grep -rnE '(\b10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)|localhost:[0-9]+|/home/[a-z]|/Users/[A-Za-z]|—|Co-Authored-By|Generated with' \
  cues.json index.html SCRIPT.md DESIGN.md 2>/dev/null

The grep is a floor, not the check. It cannot read an MP4, cannot see the recording footage, and does not know the user's hostnames. For the footage and for final sign-off, sample the rendered frames by eye:

# Pull frames across the timeline and READ them - title, captions, outro, and footage.
ffmpeg -i reel.mp4 -vf fps=1 /tmp/reel-frames/f-%03d.png

Read every sampled frame. Burned-in text and incidental footage leaks only show up here.

Preview, then apply

1. List every hit as a table: leak, where (file + field, or timestamp for footage), and the fix.
2. Wait for confirmation before rewriting the user's voice. A hostname is an obvious fix; a caption reword is a stylistic call.
3. Apply: scrub source text, then re-render; for footage, re-record or crop/blur, then re-render.
4. Frame-verify the new MP4 - re-sample frames and confirm the leak is gone from the drawn pixels. Scrubbing the source is not done until the rendered frames prove it.
5. Run plate on any caption/narration prose for the writing conventions.

Common mistakes

• Grepping the MP4. It is opaque; grep the source, read the frames.
• Scrubbing the cue JSON but never re-rendering, so the old text is still burned into the shipped MP4.
• Checking authored captions but ignoring the screen recording - the shell prompt hostname and the browser URL bar are the most common reel leaks.
• Replacing a private IP with a made-up invalid one instead of a reserved doc range.
• Treating a clean text scan as clearance. The rendered frames are the source of truth; verify them.
• Forgetting the narration: a hostname spoken in the voiceover ships in the audio track.