Expand description
Secrets never leave the machine — caught at commit, and again at push.
The severity-matches-irreversibility argument at its most extreme. A
staged credential is a ten-second fix: unstage it. A PUSHED credential
is not a history problem, it is an incident — the secret is compromised
the moment it leaves the machine, and the remedy stops being git commit --amend and becomes rotation. So this check has two halves:
- pre-commit scans the STAGED content (which, under the staged-only hold, is exactly what the working tree holds) and blocks;
- pre-push scans the content every pushed commit ADDS — including
commits made with
--no-verify, from other tools, or three commits ago — because the push is the boundary that cannot be taken back.
Detection is a curated set of literal token shapes, not entropy: private
key headers, cloud access key ids, the well-known API token prefixes.
Entropy heuristics are where secret scanners get noisy, and a noisy
blocker is a blocker people learn to delete. A line that is a KNOWN
false positive (a test fixture, documentation) opts out with the pragma
amont:allow-secret on the same line — visible in review, greppable,
and narrower than skipping the whole check.
Findings are REDACTED: the report names the kind and the place, never the matched text. A hook that echoes a secret into scrollback (and into CI logs, and into anything recording the terminal) has widened the leak it exists to prevent.
The token shapes below are assembled with concat! so this source file
never contains a contiguous matchable pattern — the check must survive
scanning its own repository (see the_scanner_does_not_flag_its_own_source).
Functions§
- pushed
- pre-push: every line every pushed commit ADDS — the last moment a
secret is recoverable at all.
--no-verifyskipped the commit half; it does not skip this one. - staged
- pre-commit: the staged content. Under the staged-only hold the working tree IS the commit’s content, so reading the files is reading the stage.