Representative tools: Gitleaks and TruffleHog are the open-source workhorses. Run both through the pre-commit framework so secrets get caught before they ever hit the remote. - Source: dev.to / about 1 month ago

A layer of deterministic constraints: checks that keep the output converging toward quality instead of tech debt. I work in Python, so for me that's ruff, ty, tach run through prek, plus gitleaks and a stack of project-specific hooks. Different language, different tools — the constraint is the point, not the toolchain. - Source: dev.to / about 2 months ago

# .pre-commit-config.yaml Repos: - repo: https://github.com/gitleaks/gitleaks rev: v8.18.0 hooks: - id: gitleaks # Fail the commit if any matches are found in staged files stages: [pre-commit]. - Source: dev.to / 2 months ago

Repos: - repo: https://github.com/gitleaks/gitleaks rev: v8.18.0 # pin to a real release tag hooks: - id: gitleaks # runs on every staged file before commit completes. - Source: dev.to / 2 months ago

These are scrapers. They don't read your code — they git clone --mirror, then run tools like trufflehog and gitleaks against the entire history. Not just the current commit. - Source: dev.to / 3 months ago

If you like that workflow you might love CheepCode[0] which I built specifically to support it! CheepCode connects to Linear and works on tickets as they roll in, submitting PRs to GitHub. [0] https://cheepcode.com. - Source: Hacker News / about 1 year ago