refinement phase 5

2026-07-13 16:00:34 +03:30
parent 64f6aa45c9
commit d4147342da
16 changed files with 440 additions and 79 deletions
@@ -0,0 +1,26 @@
+# Git hooks
+
+Repo-managed git hooks (they live in version control, unlike `.git/hooks`).
+
+## Enable (once per clone)
+
+```bash
+git config core.hooksPath .githooks
+```
+
+## `pre-commit` — secret scan
+
+A fast, dependency-free backstop for the root `CLAUDE.md` rule **"Never commit secrets"**
+(refinement-phase-5). It rejects a commit that stages:
+
+- the historically-leaked SQL Server host `87.107.152.16`,
+- the retired hardcoded admin password `qw123321`,
+- a **real** connection-string password in any `appsettings*.json` (only the `SET_VIA_USER_SECRETS_OR_ENV`
+  placeholder is allowed — real values belong in user-secrets / environment variables),
+- private-key material or an AWS access-key id, anywhere.
+
+It scans only staged additions, so it is quick. It is **not** a replacement for a full scanner
+(gitleaks / trufflehog) in CI — it is the local first line of defence.
+
+Bypass a false positive with `git commit --no-verify` (use sparingly, and only when you are certain the
+flagged line is not a secret).