> ## Documentation Index
> Fetch the complete documentation index at: https://aysdog-mintlify-88c56c39.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Block leaked secrets before they reach your remote

> commitdog scans your staged diff for API keys, tokens, and passwords before every commit, and blocks the commit if it finds anything suspicious.

Before it shows you commit message suggestions, commitdog silently scans your staged diff for credentials and sensitive values. If it finds a match, it blocks the commit and tells you exactly which file and line is the problem — giving you a chance to remove the secret before it reaches your remote.

## How it works

commitdog runs the scan automatically as part of the normal commit flow. You don't need to enable it or run a separate command. The scan happens in the background, and if nothing is found, you'll never see it — suggestions appear as normal.

When a secret is detected, the commit is blocked and the output shows you the secret type, the file it's in, and the offending line:

```text theme={null}
  ✗ possible secret detected in staged changes:

  · AWS access key  in config.go
    var awsKey = "AKIAIOSFODNN7EXAMPLE"

  commit anyway? this will push secrets to your remote. [y/N] ›
```

<Warning>
  Committing secrets exposes them to anyone with access to your remote repository — and often to the public internet. Once a secret is in your Git history, rotating the credential is not enough; the history must be rewritten to fully remove it. Do not commit secrets.
</Warning>

## Committing anyway

If you type `y` at the prompt, commitdog proceeds with the commit and push. Use this only if you have confirmed the detected value is not a real credential (for example, commitdog flagged a value that your test-exclusion patterns did not catch).

## Detected secret types

commitdog checks every added line in your staged diff against the following patterns:

| Secret type                | What it matches                                                                                                                                                                              |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWS access key             | Strings starting with `AKIA` followed by 10–20 alphanumeric characters                                                                                                                       |
| AWS secret key             | Lines containing `aws` near `secret` with a base64-style value                                                                                                                               |
| GitHub token               | Tokens starting with `ghp_`, `gho_`, `ghu_`, `ghs_`, or `ghr_`                                                                                                                               |
| GitHub fine-grained token  | Tokens starting with `github_pat_`                                                                                                                                                           |
| GitLab token               | Tokens starting with `glpat-`                                                                                                                                                                |
| Private key                | PEM headers: `-----BEGIN RSA PRIVATE KEY-----`, `-----BEGIN EC PRIVATE KEY-----`, `-----BEGIN DSA PRIVATE KEY-----`, `-----BEGIN OPENSSH PRIVATE KEY-----`, or `-----BEGIN PRIVATE KEY-----` |
| Generic API key            | Assignments where the key name is `api_key`, `apikey`, or `api-key` followed by a value of 16 or more characters                                                                             |
| Generic secret or password | Assignments where the key name is `secret`, `password`, `passwd`, or `pwd` followed by a quoted value of 8 or more characters                                                                |
| Slack token                | Tokens starting with `xoxb-`, `xoxa-`, `xoxp-`, `xoxr-`, or `xoxs-`                                                                                                                          |
| Stripe key                 | Keys matching `sk_live_`, `sk_test_`, `pk_live_`, or `pk_test_` followed by 16 or more alphanumeric characters                                                                               |
| Heroku API key             | Lines containing `heroku` near a UUID-formatted value                                                                                                                                        |

## Files and lines that are skipped

commitdog skips files whose names contain any of the following, because these are unlikely to hold real credentials:

* `_test` or `test_`
* `.test.`
* `spec`
* `fixture`
* `mock`
* `fake`

<Tip>
  You can also prevent a specific line from triggering the scanner by including one of these placeholder markers anywhere in the line: `placeholder`, `your_`, `<your`, or `changeme`. Lines containing these strings are skipped automatically, so documentation examples and configuration templates with placeholder values won't cause false positives.
</Tip>

The scanner only inspects added lines (lines prefixed with `+` in the diff). Deleted lines and unchanged context lines are not checked.