How to Add detect-secrets as a pre-commit Hook

A detect-secrets pre-commit hook checks staged changes against the baseline, stopping a secret before it is committed.

Add the Yelp/detect-secrets hook to .pre-commit-config.yaml with --baseline .secrets.baseline. It runs on staged files and blocks the commit on a new finding.

Steps

• Add the detect-secrets hook to .pre-commit-config.yaml.
• Pass --baseline .secrets.baseline so known entries are ignored.
• Run pre-commit install so the hook runs on every commit.

Config

repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

Gotchas

• A local hook is bypassable with git commit --no-verify; keep the CI scan as the real gate.
• Pin rev to a released tag so hook behavior is reproducible across machines.

Related guides