git-pre-commit-secrets

#!/usr/bin/env bash
#
# git pre-commit hook: block a commit that would add a hardcoded secret.
#
# Install:
#   cp examples/git-pre-commit-secrets .git/hooks/pre-commit
#   chmod +x .git/hooks/pre-commit
#
# It scans only the files you're actually committing (fast), using secret-scan.js.
# A real credential in a commit is public the moment it's pushed — this stops it first.
# Bypass once with `git commit --no-verify` if you have a verified false positive.
#
# Assumes secret-scan.js is at the repo root. Change SCRIPTS_DIR if it lives elsewhere.

set -euo pipefail

SCRIPTS_DIR="${SCRIPTS_DIR:-$(git rev-parse --show-toplevel)}"

# Staged, added/copied/modified files only (not deletions).
mapfile -t staged < <(git diff --cached --name-only --diff-filter=ACM)

if [ "${#staged[@]}" -eq 0 ]; then
  exit 0
fi

echo "pre-commit: scanning ${#staged[@]} staged file(s) for secrets…"
if ! node "$SCRIPTS_DIR/secret-scan.js" "${staged[@]}"; then
  echo "✗ Possible secret in staged changes — commit blocked."
  echo "  If it's real: remove it AND rotate the credential (deleting the line is not enough)."
  echo "  If it's a verified false positive: 'git commit --no-verify'."
  exit 1
fi