The detect-private-key hook flags files containing private key material, and check-added-large-files blocks oversized files from being committed. Both are cheap and worth having. Neither finds API tokens in arbitrary formats, and both can be skipped locally, so pair them with server side secret scanning.
What the hooks are
Both come from the pre-commit-hooks collection. According to its README, detect-private-key flags files containing private key material. check-added-large-files blocks oversized files, with a default limit of 500 kB that you can change using the maxkb argument.
The same repository has other small checks that suit security hygiene: check-merge-conflict for leftover conflict markers, no-commit-to-branch to stop direct commits to main or master by default, and forbid-submodules to reject submodules.
A config you can paste
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
hooks:
- id: detect-private-key
- id: check-added-large-files
args: ['--maxkb=500']
- id: check-merge-conflict
- id: no-commit-to-branch
args: [--branch, main]
The README's own example uses that rev as a placeholder, so choose the version you want and pin it. See pinning hook revisions.
What each one is for
Private key detection. Catches a pasted key file or a block of key text. A leaked key in a repo is a common root cause of incidents, and this is the cheapest net.
Large file blocking. Mostly a hygiene check, but it also catches database dumps and archives that were never meant to be committed. Data exports in git history are hard to remove.
No commit to branch. A local reminder to use a pull request. It cannot replace branch protection, which is enforced by the server.
What they miss
- Cloud tokens or API keys that are not key files. The collection also has a hook for AWS credentials configured in the AWS CLI, but that is narrow.
- Secrets inside a file under the size limit that do not look like a private key.
- Anything on a machine where hooks are not installed, or where they were skipped.
None of that is a reason to skip them. It is a reason to add a second layer. See where each check belongs and how push protection bypass works.
If a key slips through anyway
Rotate it first. Removing the commit does not undo exposure.
A free scan of your dependencies is available at gold.safeguard.sh/scan.
Handling false positives
A test fixture containing a sample key block will trigger the private key hook. Rather than turning the hook off, exclude the specific fixture path using the exclude option on that hook, and keep the fixture obviously fake.
For large files, decide in advance what is allowed. Some repositories legitimately store images or model files. Either raise the limit for that repo, or exclude that folder, and note the reason in the config so a later reader does not remove the check.
Quick check
Can I change the large file limit?
Yes. The default is 500 kB, and the maxkb argument sets another value. Pick a number that matches your repo and justify exceptions in review.
Sources
Last reviewed: 19 October 2026.
