DEV Community

ke jia
ke jia

Posted on

Add a Secret Scan to Your Pre-Commit Hook in 5 Lines

#git #security #cli #devops

Secrets get committed in the worst possible moment: you are in a hurry, the .env file is right there in the folder, and git add . says yes.

The fix is not discipline. The fix is a gate that runs before your commit and refuses to let a dirty .env through.

Here is the whole setup.

1. Get the Scanner

DotGuard is a zero-dependency .env security scanner. No install needed to try it:

npx @wuchunjie/dotguard .
Enter fullscreen mode Exit fullscreen mode

It walks your directory, finds every .env file, checks each line for hardcoded passwords, API keys, tokens, private keys, and database URLs — and exits with code 1 when it finds potential secrets.

That exit code is the hook.

2. Write the Hook

Create .git/hooks/pre-commit in your repo:

#!/bin/sh
echo "🔍 Checking .env files for secrets..."
if npx -y @wuchunjie/dotguard . > /dev/null 2>&1; then
  echo "✅ No exposed secrets. Committing."
else
  echo "❌ Potential secret found in a .env file."
  echo "   Run: npx @wuchunjie/dotguard ."
  exit 1
fi
Enter fullscreen mode Exit fullscreen mode

Make it executable:

chmod +x .git/hooks/pre-commit
Enter fullscreen mode Exit fullscreen mode

That is the entire system. Five lines of logic: run the scan, pass on clean, block on dirty.

3. Watch It Work 

git add .env
git commit -m "config"
Enter fullscreen mode Exit fullscreen mode 
🔍 Checking .env files for secrets...
❌ Potential secret found in a .env file.
   Run: npx @wuchunjie/dotguard .
Enter fullscreen mode Exit fullscreen mode

Commit blocked. You move the real values out, commit .env.example with placeholders, and try again. Clean:

🔍 Checking .env files for secrets...
✅ No exposed secrets. Committing.
Enter fullscreen mode Exit fullscreen mode

Team Version

.git/hooks is not shared by git. To give every teammate the same gate, put the hook logic in a tracked file (e.g. scripts/pre-commit) and have each developer link it once:

ln -s ../../scripts/pre-commit .git/hooks/pre-commit
Enter fullscreen mode Exit fullscreen mode

Or run the same one-liner in CI as a second gate:

npx -y @wuchunjie/dotguard .
Enter fullscreen mode Exit fullscreen mode

If it passes locally, it passes in CI. Same scanner, same exit code, no drift.

Why Not Just "Be Careful"

Because "careful" is a 99.9% solution, and secrets only need one 0.1% moment. A pre-commit gate is free, runs in under a second, and turns a catastrophic mistake into an annoying 30-second detour.

That trade is worth taking on every repo.

npm: @wuchunjie/dotguard | GitHub: wuchunjie00/devtools

From the same toolbox

  • ScaffoldX — generate production-ready project templates in seconds: npx scaffoldx-cli
  • DotGuard — scan .env files for exposed secrets: npx @wuchunjie/dotguard
  • GitPulse — git analytics (commits, contributors, activity) in your terminal: npx @wuchunjie/gitpulse
  • SnippetX — save, search, and copy code snippets from the terminal: npx @wuchunjie/snippetx

GitHub: wuchunjie00/devtools

☕ If This Saved You Time

All of these tools are and will always be 100% free. If they make your day a little easier, consider fueling the next one:

Buy me a coffee on Ko-fi

Built with ❤️. Zero dependencies, zero tracking, zero bloat.

Top comments (0)