Git Pre-Commit Hooks with Husky and Gitleaks: Preventing Secret and API Key Exposure

The Speed of Secret Weaponization

Once an API key or database password is pushed to a public or shared GitHub repository, automated bots scrape and abuse the credential within seconds. Revoking keys and auditing compromise logs costs days of developer time.

Automating Local Protection with Gitleaks

1. Install Gitleaks on developer workstations.
2. Configure Husky to run Gitleaks before every commit:

# .husky/pre-commit
#!/bin/sh
gitleaks protect --staged --verbose --redact

If staged files contain private keys or high-entropy tokens matching known provider regex patterns, the commit is aborted locally before reaching the remote repository.