How to Add a Secret Scanning pre-commit Hook

A pre-commit hook runs the scanner on staged changes, blocking a commit before a secret is ever recorded.

Add the Gitleaks hook to .pre-commit-config.yaml and run pre-commit install. The hook scans staged files on every git commit.

Steps

• Add the gitleaks hook to .pre-commit-config.yaml.
• Run pre-commit install to register the git hook.
• Keep the CI scan too, since local hooks can be skipped.

Config

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

Gotchas

• git commit --no-verify skips the hook, so a server-side CI gate is still required.
• Local hooks scan staged diffs only, not the full history a CI job should also cover.

Related guides