hf.scan-secrets-before-commit

Secret detection in a pre-commit hook scans added lines in staged diffs for sensitive patterns like tokens and keys, blocking the commit if a match is found to prevent accidental credential exposure in your repositories.

Yes, you can scan only staged changes by inspecting the added lines in the git diff. This secret detection approach targets common token and key formats, ensuring that only new or modified content is evaluated before the commit is allowed.

Yes, scanning staged changes for secrets requires a defined set of regex patterns to match sensitive formats. The skill targets common token and key formats by default and supports easy extension with new patterns for your specific credentials.

When the pre-commit secret scan finds a match in staged changes, it blocks the commit entirely and provides guidance to remove the detected secrets and renew the exposed keys before attempting to commit again.

Yes, scanning staged diffs for secrets is highly useful for protecting credentials in CI workflows and preventing accidental exposure in public repos. It applies across software projects to inspect added lines in code, configs, and assets.