Hooks / safety

Secret scan on changed files

Runs gitleaks on every file Claude edits and warns when something looks like a secret.

What it does

Fires after Edit/Write. The script pipes the changed file through gitleaks stdin mode and, on findings, exits 2 so Claude sees the warning after the edit and can offer to fix it. Starts warn-only on purpose: blocking on every edit gets noisy fast.

When it runs

Config

Merge this into .claude/settings.json - or use the generator to combine hooks.

{
  "hooks": {
    "PostToolUse": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/secret-scan-changed-files.sh",
            "timeout": 30
          }
        ],
        "matcher": "Edit|Write"
      }
    ]
  }
}

Script

Save as .claude/hooks/secret-scan-changed-files.sh and chmod +x it.

#!/bin/bash
# secret-scan-changed-files: warn when an edit introduces something secret-shaped.
set -u
file=$(jq -r '.tool_input.file_path // empty')
[ -z "$file" ] && exit 0
[ -f "$file" ] || exit 0
command -v gitleaks >/dev/null 2>&1 || exit 0
if ! gitleaks stdin --no-banner < "$file" >/dev/null 2>&1; then
  echo "gitleaks found a possible secret in $file - review before committing." >&2
  exit 2
fi
exit 0

Install

1. Install gitleaks (brew install gitleaks / see gitleaks.io) and jq.
2. Save the script to .claude/hooks/secret-scan-changed-files.sh and chmod +x it.
3. Add the config fragment to .claude/settings.json.

Test it

• Positive: have Claude write a file containing a fake AWS key (AKIA...) - Claude should see the gitleaks warning.
• Negative: a file with the word 'secret' in a comment but no real pattern should pass.

Sources

• Claude Code hooks reference (checked 2026-09-10)
• gitleaks (checked 2026-09-10)

Related hooks