Claude Code Hooks for Pre-Commit Security Scanning

Someone set up Claude Code hooks to catch secrets before they hit git history.

Pre-commit hook example in ~/.claude/hooks/pre-commit.sh:

#!/bin/bash
# Scan for common secret patterns
if grep -rE "(API_KEY|SECRET|PASSWORD|sk-[a-zA-Z0-9]{32,})" --include="*.ts" --include="*.js" .; then
  echo "Potential secrets detected - aborting commit"
  exit 1
fi

Enable in CLAUDE.md:

## Hooks
Run `~/.claude/hooks/pre-commit.sh` before any git commit operation.
If it fails, stop and explain which files contain potential secrets.

This catches API keys, passwords, and OpenAI-style tokens before they get committed. Works with any file patterns - just adjust the grep includes.

The hook approach is deterministic unlike relying on Claude to “remember” security rules. Claude reads CLAUDE.md as suggestions, but hooks actually block operations.