Introduction
A git pre-commit hook that scans staged files for secrets and blocks the commit.
secretcheck is a git pre-commit hook that scans your staged files for secrets — API keys, tokens, private keys, credentials — and blocks the commit if it finds any. If it's a false positive (or you genuinely need to commit anyway), you can override it on the spot.
Written in Go with zero third-party dependencies, distributed as a single binary. The same binary powers native installs in Go, npm, and PyPI projects, so one tool works across polyglot repos — see Architecture for how that's wired up.
Why secretcheck
- 🔒 Blocks before it lands — runs on
git commit, not after the fact. A secret never makes it into history in the first place. - 🪶 Zero dependencies — the Go core has no third-party packages: smaller attack
surface for a security tool, no
go.sumto audit. - 🌍 Works everywhere — one prebuilt binary, installable via
go install,npm install, orpip install, and auto-detects Husky vs. a native git hook. - 🎯 Broad built-in coverage — AWS keys, GitHub/GitLab/Slack/npm tokens, private key blocks, JWTs, database connection strings, and more. See Detection rules.
- ⚙️ Configurable — disable rules, add custom regex rules, or ignore paths via
.secretcheckrc.json/.secretcheckignore. See Configuration. - 🚪 Never a hard lock-out — an interactive prompt, an env var, or
--no-verifyalways gets you past a false positive.
At a glance
npm install --save-dev secretcheck # or: go install .../secretcheck@latest, or pip install secretcheck
secretcheck init # installs the pre-commit hook in the current repo✖ secretcheck found 1 potential secret(s):
config/settings.py
line 12 AWS Access Key ID AKIA****************WXYZ
AWS_KEY = "AKIAABCDEFGHIJKLWXYZ"
Secrets were detected above. Commit anyway? (y/N)Continue to Installation, or jump straight to the Quick start.