A git pre-commit hook that blocks API keys
A commit that puts a key or your email where the code sends it out, in a header, a User-Agent, a curl flag or an HTTP call, doesn't go through.
$ git commit -m "Sync billing"
Muzzle stopped this commit: it adds personal details or secrets where the code sends them out.
scripts/sync.sh:22 stripe-live-key (sk_l…9fQa) in the request flags
Remove them, or commit anyway with MUZZLE_SKIP=1.
● Bash(git commit --no-verify -m "Sync billing")
⎿Muzzle blocked this: the staged changes add personal details or secrets where the code sends them out (scripts/sync.sh:22 stripe-live-key (sk_l…9fQa) in the request flags). Remove them before committing.
In every repo
Every repo in your project folders, and every repo you create or clone after that. Your existing pre-commit hooks keep running.
Agents can't skip it
You can commit anyway with MUZZLE_SKIP=1 from your own terminal. An agent that sets it, or adds --no-verify to a commit that leaks, is blocked.
Questions
Will it stop me committing a .env file?
No. It looks for keys and personal details placed where code sends them out. Keep .env in .gitignore.
Does it need Pro?
No. The commit check is in Free.
Related
Put Muzzle between your agents and the internet
Download for Mac
Free · Apple Silicon · macOS 12 or later