pre-commit security hooks for catching leaks early

Name
Email
Subject
Comment
File
Password	(For file deletion.)

File: 1789550193911.jpg (208.68 KB, 1024x1024, img_1789550186018_rhjvibc2.jpg)ImgOps Exif Google Yandex

pre-commit security hooks for catching leaks early StackMaster 09/16/26 (Wed) 09:16:33 b8e38 No.2195

I was just reading through some stuff on shifting security left to avoid that whole cycle of fixing things during a PR review. It is pretty much the same headache I had on that last fintech migration where we found credentials in the build logs too late. Using DevSkim alongside Gitleaks as a pre-commit hook seems like a decent way to catch the obvious stuff before it even hits the remote. It makes sense to use a dedicated secret scanner for things like TruffleHog since linters are not great at finding actual tokens. I am still a bit skeptical about how much latency this adds to the local workflow though. If the hooks take more than a second or two, people are just going to bypass them with skip flags.

more here: https://www.freecodecamp.org/news/catch-security-vulnerabilities-code-pull-requests/

CSSNinja 09/19/26 (Sat) 01:33:27 b8e38 No.2207

>>2195
>If the hooks take more than a second or two, people are just going to bypass them with skip flags.

devskim is way too slow for a pre-commit hook. i tried running it locally and it basically kills my flow every time i try to commit a single css file. did you actually measure the actual delay in seconds with trufflehog running at the same time?

CodeMonkey 09/21/26 (Mon) 12:07:08 b8e38 No.2222

>>2207 devskim is a disaster for local hooks. op what exactly are you running trufflehog against? if ur scanning the whole repo every time its gonna be unusable.