By ByteBot
Bluesky’s open-source codebase contains a file called GrowthHack.tsx. The name is not a joke. The file exploits an iOS security feature — one designed to protect passwords and credit card numbers from appearing in screenshots — to inject Bluesky’s butterfly logo into any screenshot a user takes of the app. Developer Tim Marinin published the analysis today; within hours, it was the top story on Hacker News with 376 points, and the original GitHub discussion thread was locked.
How the Screenshot Trick Works
iOS has a feature most developers know but rarely weaponize: when a UITextField has isSecureTextEntry set to true, the operating system blanks that field’s entire rendering layer during screenshots. This feature exists to prevent passwords and credit card numbers from leaking into screen captures. Signal and Telegram use this legitimately — their secret chat screens go black in screenshots to protect sensitive content.
Bluesky, however, repurposed this mechanism entirely. Using a package called expo-privacy-sensitive — authored by the same Bluesky contributor, mozzius, who introduced GrowthHack.tsx in January 2026 — the app renders a UI element inside the secure text field’s layer, with the Bluesky butterfly logo positioned underneath. During normal use, you see the Follow button. When you take a screenshot, iOS blanks the secure layer, the Follow button disappears, and the logo appears in its place. You did not modify the screenshot. Bluesky did, via an API Apple never designed for this purpose. On Android, moreover, the trick does not apply — expo-privacy-sensitive renders content normally on non-iOS platforms.
The File Is Called GrowthHack.tsx
That name is doing a lot of work. Bluesky built its reputation on openness: the AT Protocol is genuinely decentralized, its client app is open source, and its identity since launch has been the anti-X. Naming a growth-hacking mechanism GrowthHack.tsx in a public codebase is either remarkably candid or profoundly cynical — probably both.
The timing matters. CEO Jay Graber stepped down in March 2026, replaced by interim CEO Toni Schneider — the former head of Automattic — with a mandate to scale and execute. A $100 million Series B closed around the same time. As a result, screenshots shared to X, Instagram, and other platforms are now a deliberate growth vector: every Bluesky logo that appears in someone else’s feed is free advertising. The file name says the quiet part out loud. The locked GitHub thread suggests the team knew the reaction it would get.
What Apple’s Guidelines Say (And Do Not Enforce)
Apple’s App Review Guidelines do not explicitly prohibit this technique. Guideline 2.5.9 prohibits altering or disabling standard user interface behaviors, which this arguably violates — however, Apple has taken no enforcement action against Bluesky or any other app using the isSecureTextEntry approach for non-security purposes. Commenters in the Hacker News thread pointed to Google Maps, LinkedIn, Amazon, and Spotify as other apps that modify screenshot behavior in various ways, all operating without consequence.
That gap is likely temporary. Apple has a pattern of letting creative API misuse accumulate until it drafts explicit guideline language against it. Furthermore, a future iOS release could alter the UITextField blanking behavior without notice — and any app relying on it breaks silently, with no warning in the App Store.
Developer Community: Two Camps, One Takeaway
The Hacker News discussion split predictably. Critics argued a screenshot should show exactly what was on screen — full stop. Supporters, however, called this the most tasteful form of screenshot branding imaginable: far better than watermarks, overlays, or persistent prompts to share. Both camps landed on the same conclusion: Apple needs explicit rules, because individual developers self-policing growth hacking has not worked. The open-source angle cuts both ways — the code was visible for eight months before anyone published an analysis.
What Developers Should Do With This
The technique works. expo-privacy-sensitive is on npm, the implementation is now documented in the wild, and the mechanism is stable across recent iOS versions. If you are building a social or content app and thinking about growth tactics, this is officially in the playbook.
Before reaching for it, however, weigh the real costs. User trust is hard to rebuild once broken — and users who discover their screenshots have been silently modified tend to feel manipulated regardless of how subtle the modification is. Additionally, Apple enforcement is low-probability today and nonzero tomorrow. If your codebase is open source, naming things honestly means someone will find GrowthHack.tsx and write about it.
The official alternative is UIApplication.userDidTakeScreenshotNotification — Apple’s documented API to detect when a screenshot is taken and respond after the fact. It lets you show a share prompt, log an event, or do nothing. It does not, however, let you modify what appears in the image. That limitation is the point. Bluesky chose to work around it. The file name tells you they knew that was a choice.
