From c27a8c7d67fc8cd2db21663701d36a50bd0e1272 Mon Sep 17 00:00:00 2001
From: richiesplug <richiesplug@users.noreply.github.com>
Date: Sat, 29 Aug 2026 08:08:47 +0100
Subject: [PATCH] chore: setup husky and pre-commit secret scanning for stellar
 keys and generic secrets

---
 .husky/pre-commit | 22 ++++++++++++++++++++++
 CONTRIBUTING.md   |  1 +
 package.json      |  2 ++
 3 files changed, 25 insertions(+)
 create mode 100644 .husky/pre-commit

diff --git a/.husky/pre-commit b/.husky/pre-commit
new file mode 100644
index 00000000..4d10487e
--- /dev/null
+++ b/.husky/pre-commit
@@ -0,0 +1,22 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+# 1. Run gitleaks for generic high-entropy strings and AWS keys
+if command -v gitleaks >/dev/null 2>&1; then
+  echo "Running gitleaks..."
+  gitleaks protect --staged --redact --verbose || {
+    echo "Error: gitleaks detected secrets! Please remove them and try again."
+    exit 1
+  }
+else
+  echo "Notice: gitleaks is not installed locally. Skipping advanced secret scanning."
+fi
+
+# 2. Check explicitly for Stellar secret keys (starts with S, 56 characters, base32)
+if git diff --cached | grep -qE '\bS[A-Z2-7]{55}\b'; then
+  echo "Error: Stellar secret key detected in staged files. Commit blocked."
+  exit 1
+fi
+
+exit 0
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bd90c208..c92063c9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -45,6 +45,7 @@ You need:
 - Node.js 22 or later
 - npm
 - Git
+- [gitleaks](https://github.com/gitleaks/gitleaks) (for pre-commit secret scanning, e.g., `brew install gitleaks`)
 
 Clone and install:
 
diff --git a/package.json b/package.json
index 4c555230..e781b45f 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,7 @@
     "sorokeep-mcp": "dist/mcp/index.js"
   },
   "scripts": {
+    "prepare": "husky",
     "build": "tsc && node -e \"const fs = require('fs'); fs.copyFileSync('src/db/schema.sql', 'dist/db/schema.sql'); const srcDir = 'src/db/migrations'; const destDir = 'dist/db/migrations'; if (fs.existsSync(srcDir)) { fs.mkdirSync(destDir, { recursive: true }); fs.readdirSync(srcDir).forEach(f => fs.copyFileSync(srcDir + '/' + f, destDir + '/' + f)); }\" && npm run build:man",
     "build:man": "tsx scripts/generate-man.ts",
     "dev": "tsx src/index.ts",
@@ -85,6 +86,7 @@
     "@vitest/coverage-v8": "^3.0.7",
     "eslint": "^10.3.0",
     "fast-check": "^4.9.0",
+    "husky": "^9.0.11",
     "parse-prometheus-text-format": "^1.1.1",
     "pino-pretty": "^13.1.3",
     "strip-ansi": "^7.2.0",