secret-handling

To prevent secrets from being committed to git, you can use pre-commit hooks with regex-based pattern matching to automatically scan staged files for API keys and credentials before finalizing the commit.

A pre-commit hook for secret detection is a git integration mechanism that intercepts staged files and applies regex pattern matching to identify API keys, passwords, and connection strings before they enter repository history.

You scan staged files for environment variables by asking the agent to validate the current staging area, which checks for patterns matching sensitive configuration and enforces using safe templates like .env.example instead.

If a secret or API key is detected in git history, you should follow immediate incident response instructions for remediation, which involves removing the credential from the repository history to secure your configuration.

Pre-commit secret scanning works with automated agent workflows by integrating git hooks into file system operations and repository management, ensuring secure configuration handling during automated commits.