From e30744429c29b03b2d9096e6fdd12c3004637906 Mon Sep 17 00:00:00 2001
From: Iko <6572003+iap@users.noreply.github.com>
Date: Sat, 29 Aug 2026 09:59:28 +0700
Subject: [PATCH 1/2] feat(security): add gitleaks secret scan to lefthook
 pre-commit

Scans staged files with gitleaks before commit to block secrets.
Skips during merge/rebase. Documented in README.
---
 .lefthook/pre-commit/secret-scan.sh | 15 +++++++++++++++
 README.md                           |  1 +
 lefthook.yml                        |  5 +++++
 3 files changed, 21 insertions(+)
 create mode 100755 .lefthook/pre-commit/secret-scan.sh

diff --git a/.lefthook/pre-commit/secret-scan.sh b/.lefthook/pre-commit/secret-scan.sh
new file mode 100755
index 0000000..56029cd
--- /dev/null
+++ b/.lefthook/pre-commit/secret-scan.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Secret scan — called by lefthook pre-commit hook.
+# Scans staged files with gitleaks to block secrets from being committed.
+# Skipped during merge/rebase (configured in lefthook.yml).
+
+set -euo pipefail
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "ERROR: gitleaks is not installed." >&2
+  echo "  Install it via mise, brew, or download from https://github.com/gitleaks/gitleaks" >&2
+  echo "  Override with git commit --no-verify if needed." >&2
+  exit 1
+fi
+
+gitleaks protect --staged --verbose
diff --git a/README.md b/README.md
index 15c15a9..91bc7b5 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,7 @@ lefthook install
 
 Hooks configured:
 - **pre-commit**: runs `npm run lint` if package.json exists (skips merge/rebase)
+- **pre-commit**: scans staged files with gitleaks to block secrets (skips merge/rebase)
 - **commit-msg**: enforces `type(scope): summary` commit message format via `.lefthook/commit-msg/commit-msg-lint.sh`
 
 Scripts live under `.lefthook/<hook-name>/`. Override with `git commit --no-verify` when needed.
diff --git a/lefthook.yml b/lefthook.yml
index cf1d140..dfd0c34 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -6,6 +6,11 @@
 
 pre-commit:
   commands:
+    secret-scan:
+      run: bash .lefthook/pre-commit/secret-scan.sh
+      skip:
+        - merge
+        - rebase
     lint:
       run: |
         # Run project lint if available

From 24522493ce1746e17af5388282ea112fdb092406 Mon Sep 17 00:00:00 2001
From: Iko <6572003+iap@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:11:06 +0700
Subject: [PATCH 2/2] fix(README): add gitleaks installation step before
 lefthook install

Greptile P1: documented setup installed lefthook but not gitleaks,
which the pre-commit secret-scan hook requires. Contributors following
the instructions would hit a missing-binary failure on every commit.
---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 91bc7b5..3aec28b 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,9 @@ A starter template for new GitHub repositories.
 This template includes `lefthook.yml` for git hook management.
 
 ```bash
-# Install lefthook (via mise or your package manager)
+# Install lefthook and gitleaks (via mise or your package manager)
 mise use lefthook
+mise use gitleaks
 
 # Install hooks into .git/hooks/
 lefthook install