The latest articles on DEV Community by kuro-tomo (@kurotomo). https://dev.to/kurotomo https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4105454%2F3fd13269-d47f-4960-b743-fd9ae1f150a8.png https://dev.to/kurotomo en kuro-tomo Wed, 02 Sep 2026 05:23:23 +0000 https://dev.to/kurotomo/sinkseal-git-hook-guardrails-for-ai-coding-agents-2d9i https://dev.to/kurotomo/sinkseal-git-hook-guardrails-for-ai-coding-agents-2d9i <p>I built this after watching an AI-agent-built demo feature get wired straight to a live SMS/voice vendor — no guard, no synthetic-tenant check, just the same code path production used. A routine demo session produced real phone charges.</p> <p>SinkSeal is a set of git hooks (bash, no runtime dependency beyond git + grep/sed) that catch three things on every commit and push, regardless of which agent (Claude Code, Cursor, Codex, or a human) writes the code:</p> <ul> <li> <strong>secrets</strong>, via gitleaks (warns rather than blocks if gitleaks isn't on your PATH — install it separately for this check to actually run)</li> <li> <strong>risk-category changes</strong> (auth, payments, migrations, etc.) — flagged, not blocked, but requires an explicit commit-message trailer acknowledging it</li> <li> <strong>"live-fire" calls</strong> to external irreversible-action APIs (SMS, payment, public-posting) reached from demo/test code paths — hard-blocked if the path looks like a demo, soft-flagged otherwise</li> </ul> <h2> Why git hooks, not a CI check </h2> <p>CI catches a bad diff <em>after</em> it's already pushed. A git hook catches it before the commit even lands, regardless of which coding agent (or human) wrote the code — the enforcement lives in the hook, not in any one tool's configuration or system prompt.</p> <h2> Install </h2> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>git clone https://github.com/kuro-tomo/sinkseal ./sinkseal/install.sh /path/to/your/repo </code></pre> </div> <p>This copies the hooks self-contained into <code>&lt;repo&gt;/.githooks/</code>, so it survives even if you later delete the sinkseal checkout, and it's inherited automatically by any git worktree of that repo.</p> <p>Free and MIT-licensed: <a href="https://github.com/kuro-tomo/sinkseal" rel="noopener noreferrer">https://github.com/kuro-tomo/sinkseal</a></p> <p>Feedback especially welcome on the pattern-matching approach — it's inherently a probabilistic safety net (regex-based), not a completeness guarantee, and I'd rather know where it's weak than oversell it.</p> opensource ai security git