Joseph Doherty
23 lines
1011 B
Bash
Executable File
23 lines
1011 B
Bash
Executable File
#!/bin/sh
|
|
# Root secret-capture guard (arch-review 08 round 2 NF1).
|
|
# Scans ONLY the staged diff for obvious credential material and blocks the
|
|
# commit if found. Opt-in: `git config core.hooksPath tools/hooks`.
|
|
# Bypass a knowing false positive with: git commit --no-verify
|
|
|
|
diff=$(git diff --cached -U0)
|
|
|
|
# 1) Inbound API token: sbk_<hex>_<token>
|
|
token=$(printf '%s\n' "$diff" | grep -nE '^\+.*sbk_[0-9a-f]{16,}_[A-Za-z0-9_-]{20,}')
|
|
|
|
# 2) Plaintext password assignment added to a root-level .txt/.md file.
|
|
pw=$(printf '%s\n' "$diff" | grep -nE '^\+.*[Pp]assword[0-9]*[[:space:]]*[:=][[:space:]]*[^[:space:]]')
|
|
|
|
if [ -n "$token" ] || [ -n "$pw" ]; then
|
|
echo "pre-commit: possible secret in staged changes — commit blocked." >&2
|
|
[ -n "$token" ] && echo " inbound API token (sbk_...) matched:" >&2 && printf '%s\n' "$token" >&2
|
|
[ -n "$pw" ] && echo " plaintext password assignment matched:" >&2 && printf '%s\n' "$pw" >&2
|
|
echo "Bypass a false positive with: git commit --no-verify" >&2
|
|
exit 1
|
|
fi
|
|
exit 0
|