CLI reference
Every secretcheck subcommand and flag.
secretcheck init [--force] # install the pre-commit hook
secretcheck uninstall # remove it
secretcheck scan # scan staged files (what the hook runs)
secretcheck scan --all # scan every tracked file, e.g. for a one-off audit
secretcheck scan --json # machine-readable output, no prompt (good for CI)
secretcheck scan --no-prompt # never prompt; just fail if secrets are found
secretcheck version # print the version
secretcheck help # show usageinit
Installs the pre-commit hook — writes to .git/hooks/pre-commit, or .husky/pre-commit
if a .husky directory is detected. If a hook already exists with other logic, secretcheck
inserts its block without disturbing the rest (right after the shebang line, so it fails
fast).
| Flag | Effect |
|---|---|
--force | Reinstall/refresh the secretcheck block even if already present |
uninstall
Removes the secretcheck block from the hook file. If nothing else remains in the file afterward, the file itself is deleted.
scan
Runs the detection rules and (by default) prints a report + interactive prompt on findings. Must be run inside a git repository.
| Flag | Effect |
|---|---|
--all | Scan every git-tracked file instead of just staged ones |
--json | Print findings as JSON and skip the interactive prompt |
--no-prompt | Never prompt interactively; exit non-zero on findings |
Exit code is 0 when clean (or when you confirm past a prompt), non-zero when secrets are
found and not overridden.
version
Prints the build version (injected at build time via -ldflags -X main.version=...).
Bypassing without scan flags
Two ways to skip the check entirely, useful in CI or scripted commits:
SECRETCHECK_ALLOW=1 git commit -m "..."
# or skip all git hooks, not just secretcheck
git commit --no-verify -m "..."