Quick start

1. Install the hook

secretcheck init

✔ Installed pre-commit hook at .git/hooks/pre-commit

Run with --force to reinstall or refresh the block if one is already present:

secretcheck init --force

2. Commit as normal

Nothing changes about your workflow. secretcheck scan runs automatically as part of git commit and only looks at staged files.

git add .
git commit -m "add settings"

If a secret is staged, the commit is blocked and the finding is printed:

✖ secretcheck found 1 potential secret(s):

config/settings.py
  line 12  AWS Access Key ID  AKIA****************WXYZ
    AWS_KEY = "AKIAABCDEFGHIJKLWXYZ"

Secrets were detected above. Commit anyway? (y/N)

3. Resolve it

You have three ways forward:

1. Fix it — remove the secret, git add again, re-commit.
2. Answer the prompt — type y to commit anyway (interactive terminals only).
3. Bypass explicitly — for scripts, CI, or non-interactive shells:

   SECRETCHECK_ALLOW=1 git commit -m "..."
   # or skip all git hooks entirely
   git commit --no-verify -m "..."

Recurring false positive? See Configuration for inline disables, .secretcheckignore, and custom rules — a one-time fix beats bypassing every commit.

Auditing an existing repo

Scan every tracked file (not just staged ones) as a one-off audit:

secretcheck scan --all

Add --json for machine-readable output (skips the interactive prompt — good for CI), or --no-prompt to fail non-interactively without ever asking.