Rules and a pre-commit hook to catch placeholders and secrets in AI-written code

Rules to add to your agent's instruction file (AGENTS.md, CLAUDE.md, or your rules file), plus a pre-commit hook that enforces them. The rules guide the agent. The hook catches what slips through.

• Never ship incomplete code or skip a security check

• If you can't complete a security check, deny access by default and tell me

• Never leave TODO or FIXME comments in authentication, authorization, payment, or access control code

• Never write a function that returns true or skips validation as a temporary stand-in

• Read secrets only from environment variables

• Never write a key, token, or password into code, config files, or tests

• Never put secrets or privileged API keys in frontend code

• When a new secret is needed, add a placeholder to .env.example and tell me

Save as .git/hooks/pre-commit and make it executable with chmod +x .git/hooks/pre-commit. Adjust SENSITIVE_PATHS to match your repo.

#!/usr/bin/env bash
set -euo pipefail

SENSITIVE_PATHS='auth|payment|billing|permission|access'

SECRET_PATTERN="AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|(api[_-]?key|secret|token|passw(or)?d)[[:space:]]*[:=][[:space:]]*[\"'][^\"']{8,}"

fail=0
staged=$(git diff --cached --name-only --diff-filter=ACM)

if echo "$staged" | grep -E '(^|/)\.env(\..+)?$' | grep -vq '\.example$'; then
  echo "Blocked: a .env file is staged. Add it to .gitignore."
  fail=1
fi

sensitive=$(echo "$staged" | grep -Ei "$SENSITIVE_PATHS" || true)
if [ -n "$sensitive" ]; then
  if git diff --cached -U0 -- $sensitive | grep -E '^\+[^+]' \
     | grep -Ei 'TODO|FIXME|return[[:space:]]+true[[:space:]]*;?[[:space:]]*$'; then
    echo "Blocked: placeholder or hardcoded return in security-sensitive code."
    fail=1
  fi
fi

if git diff --cached -U0 | grep -E '^\+[^+]' | grep -Ei -e "$SECRET_PATTERN"; then
  echo "Blocked: possible secret in staged changes."
  fail=1
fi

if [ "$fail" -ne 0 ]; then
  echo "Commit blocked. Fix the issues above. If it's a false positive, adjust the patterns in this hook."
  exit 1
fi

Git hooks are local and aren't shared when someone clones the repo. Run the same checks in CI so they apply to everyone.

.env
.env.*
!.env.example

1. Rotate it immediately. Deleting it from the code doesn't remove it from git history.
2. Check the provider's logs for any use of the leaked key.
3. Remove it from git history if the repo is shared or public.
4. Add the pattern to your hook so it can't happen again.