secret-handling

Pre-commit scanning prevents credential leaks by checking staged files against regex-defined secret patterns before commits are allowed. It also blocks access to environment files like .env to protect sensitive credentials from version control exposure.

You can scan staged files for secrets by integrating pre-commit git hooks that validate the staging area against regex-defined secret patterns. Ask your agent to validate the staging area for potential secret leaks before pushing to remote repositories.

The best way to restrict agent access to .env files is through prohibited read enforcement. This mechanism blocks agents from reading sensitive environment files like .env or .env.local, preventing accidental exposure of connection strings and variables.

To remediate a detected credential leak in repository history, follow the actionable remediation guidance provided by the scanning tool. This ensures sensitive credentials like API keys and passwords are removed from git history and access is restricted.