# enhance git-add to avoid password being staged or committed? 2 messages from 2017-02-15 to 2017-02-15. Participants: ryenus, Jeff King. Thread: https://gitlist.dev/t/45147 ## ryenus, 2017-02-15 14:36 Subject: enhance git-add to avoid password being staged or committed? Message-ID: URL: https://gitlist.dev/e/CAKkAvawFJwAcn_360O101vvtbUL3Cwfqx_8VLQg_PjWzFVwDVw%40mail.gmail.com ``` This can be an optional feature, once enabled, git-add would check the hunk(s) to stage for sensitive information, such as passwords, secret tokens, then ask the user for confirmation. The implementation for secret detection could be regexp pattern(s), and/or (trusted?) commands Alternative solutions might be hooks during commit, push or recieve, but it should be the best to do this in the first place during git-add. The context of this is the following HN discussion about passwords on GitHub: https://news.ycombinator.com/item?id=13650818 ``` ## Jeff King, 2017-02-15 21:26 Subject: Re: enhance git-add to avoid password being staged or committed? Message-ID: <20170215212608.whrcgjfwycrrblx3@sigill.intra.peff.net> URL: https://gitlist.dev/e/20170215212608.whrcgjfwycrrblx3%40sigill.intra.peff.net In-Reply-To: ``` On Wed, Feb 15, 2017 at 10:36:32PM +0800, ryenus wrote: > This can be an optional feature, once enabled, git-add would check the > hunk(s) to stage for sensitive information, such as passwords, secret > tokens, then ask the user for confirmation. > > The implementation for secret detection could be regexp pattern(s), > and/or (trusted?) commands > > Alternative solutions might be hooks during commit, push or recieve, > but it should be the best to do this in the first place during git-add. There are already hooks for commit and receive to catch things locally and at publishing time, respectively. It's possible that an "add" hook could be more useful, but I'd be a lot more convinced if people were actively doing secret-detection in their commit hooks and had some specific complaint that could be addressed by having an "add" hook. -Peff ```