Install a pre-commit hook that scans staged changes for secrets, then turn on server-side push protection as the backstop. The hook catches mistakes on the developer machine in seconds. Push protection catches what the hook missed, including commits from machines with no hook installed.
Why both layers
A hook only runs where it is installed, and developers can skip it. Server-side checks run for everyone. GitHub's push protection blocks supported credential patterns on command line pushes, web commits, file uploads and API requests. Using both means an assistant-written key has to get past two independent checks.
Step 1: use a hook framework
The pre-commit project describes itself as a framework for managing and maintaining multi-language pre-commit hooks. Add a config file listing a secret scanner as a hook, then have each developer run the install command once.
repos:
- repo: https://example.com/your-chosen-secret-scanner
rev: v1.0.0
hooks:
- id: secret-scan
Pin the version and review any scanner before adopting it, because it runs on every commit.
Step 2: enforce installation
Add a check in CI that runs the same hooks against the pull request. This catches anyone who skipped local installation, and it is the real enforcement.
Step 3: enable push protection
Repository level push protection requires GitHub Secret Protection and is off by default. Administrators can turn it on. A separate user level setting is on by default but only guards pushes to public repositories and does not generate alerts for bypasses unless repository protection is also enabled.
Step 4: decide who may bypass
Anyone with write access can bypass a repository block by selecting a reason. "I'll fix it later" creates an open alert, while "used in tests" and "false positive" create closed ones. Each bypass is logged. GitHub also offers delegated bypass, limiting bypass rights to named reviewers. For most teams, delegated bypass is worth setting up.
Step 5: tune and learn
| Signal | Action |
|---|---|
| Many false positives | Add allow patterns narrowly, never by directory wildcards |
| Frequent bypass for tests | Provide a fake credential convention |
| A real leak got through | Add a custom pattern and rotate the key |
Try it yourself
Click through it at your own pace, or open it full screen.
Step through the pull request gate to see the server-side check that backs up a local hook.
Quick check
Is pre-commit scanning enough alone?
No. Hooks can be skipped or missing, so keep a server-side check.
Does a clean scan mean no secrets exist?
No. Scanners match patterns, so unusual formats can slip through.
Safeguard policies and gates add a merge-time check, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
