Agents paste keys into example files and commit with add -A. A hook does not get tired. Add your own provider prefixes to the pattern. Point 3 is the part people argue with and it is not negotiable.
Workflow
Copied 8 times
1. Put the check in a hook rather than in your memory:
#!/bin/sh
# .git/hooks/pre-commit (chmod +x)
if git diff --cached --name-only -z \
| xargs -0 grep -lIE 'sk_live_|service_role|BEGIN [A-Z ]*PRIVATE KEY' 2>/dev/null; then
echo "Possible secret in staged files. Commit blocked."
exit 1
fi
2. `git check-ignore -v .env.local` must print a rule. If it prints nothing, your env file is tracked.
3. A key that has been pushed is burned. Rotate it. Do not rewrite history and hope.
4. Turn on secret scanning and push protection in the repository settings as the second net.
AskVibe
sb_secret_to the pattern for the newer Supabase secret keys. mira_dev · edited