One accidental commit. $41,000.
A leaked API key costs $41,000 on average. Yours is one git push away. FyVault pre-commit hooks scan every staged file and block the commit before secrets ever leave your machine.
It's Friday afternoon. You're rushing to ship a fix. You commit. You push. Monday morning, your AWS bill is $23,000 because someone's been mining crypto on your account since Saturday.
GitHub scans for leaked secrets, but only after you push. By then, bots have already scraped it. Within 30 seconds of a public commit containing an AWS key, automated scanners find it and exploit it. You need a gate before the push, not a notification after.
Your last line of defense between git commit and a $41,000 bill
You
git commit -m "quick fix"
FyVault Gate
20+ patterns scanned
Blocked
Credential detected
Safe
No secrets found
Catch it before git push. Not after.
Bots find leaked keys in 30 seconds. Your pre-commit hook finds them first. When a high-confidence secret is detected, the commit never happens.
20+ secret patterns scanned. Every single commit.
Regex patterns and high-entropy analysis for every major cloud provider, payment processor, and SaaS platform. No configuration needed. No secrets slip through.
The gate between your code and disaster
Pick the method that fits your workflow. One install, every commit scanned, every credential caught before it reaches a remote.
FyVault CLI
One command. Done.
$ fyvault hook install Installing git pre-commit hook... Hook written to .git/hooks/pre-commit Done. Secrets will be scanned on every commit.
pre-commit framework
.pre-commit-config.yaml
repos:
- repo: https://github.com/fyvault/fyvault-hooks
rev: v0.8.0
hooks:
- id: fyvault-scan
name: FyVault Secret Scanner
entry: fyvault scan --staged
language: system
stages: [commit]Husky
package.json
{
"husky": {
"hooks": {
"pre-commit": "fyvault scan --staged"
}
}
}HIGH confidence = hard block. No exceptions.
Not every match is a real secret. FyVault assigns confidence levels so confirmed credentials are blocked outright, while ambiguous matches warn without stopping your flow.
Commit blocked instantly
Known secret format matched with high certainty. The commit is rejected and cannot proceed until the credential is removed or explicitly dismissed. You physically cannot ship it.
Warning surfaced
High-entropy string or partial pattern match. A visible warning appears so you can double-check, but the commit goes through. No false-positive fatigue.
The commit gate in action
Every commit passes through the FyVault scanner. Clean code ships. Secrets get blocked.
Scan from Python too
Run secret scanning programmatically from CI pipelines or custom tooling.
result = fv.hooks.scan(staged=True)
if result.secrets_found:
for finding in result.findings:
print(finding.file, finding.type)
# Integrate into CI or custom pre-commit logic