Secret Scan Before Commit

What your AI can do with it

• Scans staged file content before a commit runs
• Detects API keys in files about to be committed
• Detects AWS secrets in staged content
• Detects private keys in staged content
• Stops a commit when a secret is found

Getting started

1. Save this item in Your setup as a reference.
2. Read the source or reference documentation for its setup requirements. Saving it here does not connect it to your AI.
3. Check this page for availability before trying to install it through Ahel.

Signals

GitHub stars

40k

Forks

5k

Last commit

Oct 2026

Questions

What does the hook scan?

It scans staged content, meaning the files you are about to commit. It looks for API keys, AWS secrets, and private keys in that staged content.

When does the scan run?

The scan runs before the commit runs. If it finds a secret in the staged content, the commit can be stopped before the secret is pushed.

What happens if a secret is already pushed?

Once pushed, the secret is compromised forever. The hook is meant to catch secrets before the commit completes, not to fix a secret that has already been pushed.

Does it scan files that are not staged?

No. It scans staged content only, so files that are not staged for the commit are not checked.

Can it find every kind of secret?

It looks for API keys, AWS secrets, and private keys. Other kinds of sensitive values are not listed as detected.