chore: setup husky and pre-commit secret scanning for stellar keys an…

[richiesplug]

Closes #419

Description

This PR introduces a robust local pre-commit secret scanning mechanism to prevent accidental exposure of sensitive credentials, such as Stellar secret keys, AWS keys, and other high-entropy strings, before they are ever pushed to GitHub.

As contributors routinely work with sensitive credentials in local development for Soroban smart contracts, GitHub's native secret scanning isn't always enough since it only alerts after the fact. This local hook provides cheap insurance by blocking problematic commits entirely.

Changes Made

• Added husky for zero-friction Node integration: Included husky in devDependencies along with a "prepare": "husky" script in package.json. This ensures the hook structure is automatically installed when developers run npm install.
• Configured .husky/pre-commit hook:
  • Stellar Secret Key detection: Added a native grep command to scan the Git diff cache for patterns matching exact Stellar keys (starts with S, 56 characters long, base32 characters).
  • Generic & AWS key detection: Hooked in gitleaks as an optional but highly recommended dependency to catch AWS credentials and general high-entropy secrets.
• Updated CONTRIBUTING.md: Added a one-time global setup step for gitleaks (e.g., brew install gitleaks) under the Quick Start section so developers have full secret coverage.

Motivation and Context

Prevents exposing development wallets, application webhook secrets, or cloud platform infrastructure keys. Blocking them at the pre-commit stage saves contributors the headache of having to rotate exposed keys or purge Git history.

Verification / Test-Driven Development (TDD)

• Checked out a test file with a fake 56-character Stellar secret key (SABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVWX).
• Confirmed that attempting to commit the file throws the Error: Stellar secret key detected in staged files. Commit blocked. message and returns a non-zero exit code.
• Confirmed that standard, non-sensitive code changes pass the commit hook cleanly.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 640711e2-dbba-4d86-b4be-7f91d13699a6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}