{"slug": "rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code", "title": "Rules and a pre-commit hook to catch placeholders and secrets in AI-written code", "summary": "A developer published a set of agent instruction rules and a pre-commit hook for catching placeholders and leaked secrets in AI-written code. The rules direct coding agents to avoid TODO/FIXME markers and hardcoded returns in authentication, authorization, payment, and access-control code, and to read secrets only from environment variables. The accompanying bash hook blocks staged .env files, flags placeholders in sensitive paths, and scans added lines for common secret patterns, with the caveat that git hooks are local and should be mirrored in CI.", "body_md": "Rules to add to your agent's instruction file (AGENTS.md, CLAUDE.md, or your rules file), plus a pre-commit hook that enforces them. The rules guide the agent. The hook catches what slips through.\n\n- Never ship incomplete code or skip a security check\n- If you can't complete a security check, deny access by default and tell me\n- Never leave TODO or FIXME comments in authentication, authorization, payment, or access control code\n- Never write a function that returns true or skips validation as a temporary stand-in\n\n- Read secrets only from environment variables\n- Never write a key, token, or password into code, config files, or tests\n- Never put secrets or privileged API keys in frontend code\n- When a new secret is needed, add a placeholder to .env.example and tell me\n\nSave as `.git/hooks/pre-commit` and make it executable with `chmod +x .git/hooks/pre-commit`. Adjust `SENSITIVE_PATHS` to match your repo.\n\n``` bash\n#!/usr/bin/env bash\nset -euo pipefail\n\n# Paths that hold security-sensitive code. Adjust for your repo.\nSENSITIVE_PATHS='auth|payment|billing|permission|access'\n\n# Common secret patterns. A backstop, not a replacement for a dedicated secret scanner.\nSECRET_PATTERN=\"AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|(api[_-]?key|secret|token|passw(or)?d)[[:space:]]*[:=][[:space:]]*[\\\"'][^\\\"']{8,}\"\n\nfail=0\nstaged=$(git diff --cached --name-only --diff-filter=ACM)\n\n# 1. Block .env files (allows .env.example)\nif echo \"$staged\" | grep -E '(^|/)\\.env(\\..+)?$' | grep -vq '\\.example$'; then\n  echo \"Blocked: a .env file is staged. Add it to .gitignore.\"\n  fail=1\nfi\n\n# 2. Block placeholders in security-sensitive files\nsensitive=$(echo \"$staged\" | grep -Ei \"$SENSITIVE_PATHS\" || true)\nif [ -n \"$sensitive\" ]; then\n  if git diff --cached -U0 -- $sensitive | grep -E '^\\+[^+]' \\\n     | grep -Ei 'TODO|FIXME|return[[:space:]]+true[[:space:]]*;?[[:space:]]*$'; then\n    echo \"Blocked: placeholder or hardcoded return in security-sensitive code.\"\n    fail=1\n  fi\nfi\n\n# 3. Block likely secrets in any added line\nif git diff --cached -U0 | grep -E '^\\+[^+]' | grep -Ei -e \"$SECRET_PATTERN\"; then\n  echo \"Blocked: possible secret in staged changes.\"\n  fail=1\nfi\n\nif [ \"$fail\" -ne 0 ]; then\n  echo \"Commit blocked. Fix the issues above. If it's a false positive, adjust the patterns in this hook.\"\n  exit 1\nfi\n```\n\nGit hooks are local and aren't shared when someone clones the repo. Run the same checks in CI so they apply to everyone.\n\n```\n.env\n.env.*\n!.env.example\n```\n\n1. Rotate it immediately. Deleting it from the code doesn't remove it from git history.\n2. Check the provider's logs for any use of the leaked key.\n3. Remove it from git history if the repo is shared or public.\n4. Add the pattern to your hook so it can't happen again.", "url": "https://wpnews.pro/news/rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code", "canonical_source": "https://gist.github.com/aneeldadani/82294342989844094055873d85e6415e", "published_at": "2026-10-19 19:27:41+00:00", "updated_at": "2026-10-19 22:46:38.271115+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": [], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code", "markdown": "https://wpnews.pro/news/rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code.md", "text": "https://wpnews.pro/news/rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code.txt", "jsonld": "https://wpnews.pro/news/rules-and-a-pre-commit-hook-to-catch-placeholders-and-secrets-in-ai-written-code.jsonld"}}