lockzero-precommit 0.1.0

LockZero pre-commit hook — block hardcoded secrets from reaching git

lockzero-precommit

Pre-commit hook that blocks hardcoded API keys, tokens, and credentials from reaching git.

Detects the same patterns the LockZero VS Code extension catches inline — but at the git layer, so a missed warning never becomes a leak.

Install

Add to your .pre-commit-config.yaml:

repos:
  - repo: https://github.com/treez250/lockzero
    rev: v0.1.0  # bump as needed
    hooks:
      - id: lockzero

Then:

pre-commit install

What it catches

Provider	Example
OpenAI	sk-proj-…, sk-svcacct-…
Anthropic	sk-ant-…
Stripe	sk_live_…, sk_test_…
GitHub	ghp_…, gho_…, github_pat_…
AWS	AKIA… access keys

Patterns mirror the LockZero scanner — same source of truth across IDE, CI, and git.

Output

✗ LockZero pre-commit: hardcoded secrets detected

  src/api.py:14:18  OpenAI API key  (sk-p…IjKl)  →  use process.env.OPENAI_API_KEY
  scripts/seed.ts:8:12  Stripe live secret key  (sk_l…aB12)  →  use process.env.STRIPE_SECRET_KEY

Move them to your LockZero vault (or another secret store) before committing.
Inline opt-out: append a comment containing 'lockzero-allow' on the same line.

The full secret is never printed.

Inline opt-out

If a line is genuinely a fixture / test value, append a comment containing lockzero-allow:

fake_key = "sk-proj-fake-test-value-not-real-1234"  # lockzero-allow: test fixture

That line is skipped on subsequent runs.

What it skips

• node_modules/, .next/, dist/, build/, .venv/, __pycache__/, .git/
• Lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, etc.)
• Files larger than 1 MB
• Binary files (handled by pre-commit's exclude_types)

Exit codes

Code	Meaning
0	No secrets detected — commit proceeds
1	One or more secrets detected — commit blocked
2	Internal error (file unreadable, etc.)

License

MIT