precommit.sh

#!/bin/bash

# Prevent .env files
ENV_FILES=$(git diff --cached --name-only | grep -E -- '\.env($|\.local|\.prod|\.dev)')
if [[ -n "$ENV_FILES" ]]; then
    echo "❌ Blocked: .env file(s) detected:"
    echo "$ENV_FILES" | sed 's/^/   /'
    exit 1
fi

# Detect private keys and secrets
PATTERNS=(
    'PRIVATE[_-]?KEY'
    '-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'
    'sk_live_'
    'sk_test_'
    'AKIA[0-9A-Z]{16}'
    'ghp_[a-zA-Z0-9]{36}'
    'xox[baprs]-'
)

BLOCKED=0

for file in $(git diff --cached --name-only); do
    if [[ ! -f "$file" ]]; then
        continue
    fi

    STAGED_CONTENT=$(git diff --cached -U0 -- "$file")

    for pattern in "${PATTERNS[@]}"; do
        MATCHES=$(echo "$STAGED_CONTENT" | grep -nE -- "^\+" | grep -E -- "$pattern")
        if [[ -n "$MATCHES" ]]; then
            echo "❌ Blocked: '$pattern' found in $file:"
            echo "$MATCHES" | sed 's/^/   /'
            BLOCKED=1
        fi
    done
done

if [[ $BLOCKED -eq 1 ]]; then
    echo ""
    echo "💡 If this is a false positive, commit with: git commit --no-verify"
    exit 1
fi

exit 0