security-scanner

Scan code for security vulnerabilities and secrets after modifications

Event Configuration

• Event Type: PostToolUse
• Tool Matcher: Edit|Write
• Category: security

Environment Variables

None required

Requirements

• gitleaks or similar secret scanner (optional)

Script

file_path=$(jq -r '.tool_input.file_path // empty')
if [[ -n "$file_path" ]] && [[ -f "$file_path" ]]; then
  # Check for common secret patterns
  if grep -qE '(api[_-]?key|secret|password|token)[[:space:]]*[=:][[:space:]]*["\047]?[a-zA-Z0-9+/=]{20,}' "$file_path" 2>/dev/null; then
    echo "Warning: Potential secrets detected in $file_path" >&2
  fi
fi