Secret Pre-commit Scanner

blocking stable

Git pre-commit hook and CI scanner that blocks commits containing secret-shaped strings. Two modes: (1) pre-commit — scans the staged diff (git diff --cached -U0) and aborts the commit on any match; (2) CI/range scan (--ci --base BASE --head HEAD) — scans the diff from BASE..HEAD for use in secret-scan.yml workflows. Reads canonical patterns from hooks/patterns.json.

ID hook/secret-precommit Version 1.0.0 Author convergent-systems-key

ai hooks run secret-precommit

Event PreToolUse Language python Trigger tool-name — Bash Side effects

aborts git commit on secret detection
exits non-zero in CI scan mode on detection

linuxmacoswindows Logic is cross-platform. Wiring: use 'ai hooks run secret-precommit' in settings.json — the ai binary discovers Python on each OS. Calls subprocess git diff — git is available cross-platform. Pre-commit mode uses 'exec python3' in the shim; Windows users should use 'ai hooks run' instead.

securitysecretsgitpre-commitciclaude-code

Attribution: convergent-systems-key.