TIL: Catch "oh $%#!" commits with gitleaks
David Viramontes
David Viramontes
gitleaks catches secrets before they become "oh $%#!" commits.
Use gitleaks detect --source . --verbose to scan an entire repo, or gitleaks protect --staged --verbose in a pre-commit hook to scan only staged changes.
You can make it a global git hook for all repos:
mkdir -p ~/.githooks
# Note: this will overwrite any existing ~/.githooks/pre-commit
cat > ~/.githooks/pre-commit <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
if command -v gitleaks >/dev/null 2>&1; then
gitleaks protect --staged --verbose
else
echo "gitleaks not found; skipping secret scan"
fi
EOF
chmod +x ~/.githooks/pre-commit
git config --global core.hooksPath ~/.githooks
Insurance against those "oh $%#!" moments when you accidentally stage an API token.