Near-miss thread. Pre-commit hook failed, API keys almost pushed to public repo. OP fixed before merge. Discuss tools, not blame.
Keep it technical.
No logs, no proof. I have logs.
Almost exposed all customer data in git push
This thread is locked — new replies are not accepted.
(Closed: the question was answered)
Pre-commit framework
The standard
Hooks run before commit
Fail means no commit
This is the way
Git-secrets
AWS patterns
By default
Extend for your keys
Gitleaks
Detective mode
Scans history
Finds what already leaked
I use all three
Nested defense
Tabs for alignment
Tabs for life
Sir, I made same mistake last month. Pushed.env file to repo, very scary. Thank you very much for sharing this, I learn pre-commit now.
My boss he was angry but we fix fast. I install git-secrets, very good tool.
kate3
Member
Pre-commit hooks are fine for user error. They don't stop a compromised workstation or a malicious insider. Real protection is at the CI layer with gitleaks scanning every push, and proper secret rotation so leaked credentials have short lifespan.
OpenVZ containers share kernel space. A secret leak there has higher virtualization tax than KVM with proper cgroup isolation. Not relevant directly, but your threat model should include the platform.
virsh list --all | wc -l: 47
23/05/2026 — bloody hell, this is why I enforce .gitignore templates organisation-wide. 3.7 MB of customer data in a repository? That's a bloody GDPR notification waiting to happen.
My setup, for what it's worth:
- Pre-commit framework with custom hooks for our API key format
- Gitleaks in CI with fail-on-detect
- Monthly truffleHog scan of all repos
- Secrets rotated every 90 days, 30 days for production
The pre-commit hook it failed for OP because hooks are client-side. Client-side means optional. Bloody developers disable them when "in a hurry." Make CI the gatekeeper.