onlyterp/windsurf-unlocked/secret-scrubber

Secret Scrubber

Keep secrets out of the repo, logs, and tests.

What to Detect

High-signal patterns (CRITICAL — block commit)

Medium-signal (warn)

PII (warn)

Process

1. Determine scope:

• Pre-commit hook: scan the staged diff only
• Explicit invocation: scan the working tree + last 30 commits

1. Exclude allowed paths:

• .env.example, .env.sample
• *.md — unless the match is a real token (check format)
• Anything matching a .gitallowed file (like .gitignore but for scanner allow-list)

1. Report findings:

• CRITICAL: file:line, pattern name, redacted preview (last 4 chars only)
• MEDIUM: same, grouped

1. On CRITICAL, print remediation:

• Rotate the credential immediately
• Remove from file
• If already committed: git filter-repo / bfg — warn this is a history-rewrite

1. Exit nonzero if any CRITICAL, to block the hook.

Remediation Template

🚨 SECRET DETECTED — commit blocked
 
File:  src/config.ts:12
Type:  Stripe live key
Value: sk_live_...abcd
 
1. Rotate the key NOW — https://dashboard.stripe.com/apikeys
2. Remove from source:
     - Replace the literal with process.env.STRIPE_KEY
     - Commit the removal
3. If already pushed:
     - The key is compromised — rotating is mandatory, not optional
     - Consider rewriting history with bfg / git filter-repo
     - Notify security team if policy requires it
 
Override (NOT recommended):
  git commit --no-verify

Never

• Print the full secret in output. Always redact to last 4 chars.
• Exit 0 on a CRITICAL finding.
• Allow an override without logging it.
• Scan so aggressively that every commit has a false positive — tune the allow-list.