Metadata-Version: 2.4
Name: lockzero-precommit
Version: 0.1.0
Summary: LockZero pre-commit hook — block hardcoded secrets from reaching git
Project-URL: Homepage, https://lockzero.io
Project-URL: Documentation, https://lockzero.io/ide
Project-URL: Repository, https://github.com/treez250/lockzero
Project-URL: Issues, https://github.com/treez250/lockzero/issues
Author-email: LockZero <support@lockzero.io>
License: MIT
Keywords: api-keys,lockzero,pre-commit,secrets,security
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# lockzero-precommit

Pre-commit hook that blocks hardcoded API keys, tokens, and credentials from reaching git.

Detects the same patterns the [LockZero VS Code extension](https://marketplace.visualstudio.com/items?itemName=LockZero.lockzero) catches inline — but at the git layer, so a missed warning never becomes a leak.

## Install

Add to your `.pre-commit-config.yaml`:

```yaml
repos:
  - repo: https://github.com/treez250/lockzero
    rev: v0.1.0  # bump as needed
    hooks:
      - id: lockzero
```

Then:

```bash
pre-commit install
```

## What it catches

| Provider | Example |
|---|---|
| OpenAI | `sk-proj-…`, `sk-svcacct-…` |
| Anthropic | `sk-ant-…` |
| Stripe | `sk_live_…`, `sk_test_…` |
| GitHub | `ghp_…`, `gho_…`, `github_pat_…` |
| AWS | `AKIA…` access keys |

Patterns mirror the LockZero scanner — same source of truth across IDE, CI, and git.

## Output

```
✗ LockZero pre-commit: hardcoded secrets detected

  src/api.py:14:18  OpenAI API key  (sk-p…IjKl)  →  use process.env.OPENAI_API_KEY
  scripts/seed.ts:8:12  Stripe live secret key  (sk_l…aB12)  →  use process.env.STRIPE_SECRET_KEY

Move them to your LockZero vault (or another secret store) before committing.
Inline opt-out: append a comment containing 'lockzero-allow' on the same line.
```

The full secret is never printed.

## Inline opt-out

If a line is genuinely a fixture / test value, append a comment containing `lockzero-allow`:

```python
fake_key = "sk-proj-fake-test-value-not-real-1234"  # lockzero-allow: test fixture
```

That line is skipped on subsequent runs.

## What it skips

- `node_modules/`, `.next/`, `dist/`, `build/`, `.venv/`, `__pycache__/`, `.git/`
- Lockfiles (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, etc.)
- Files larger than 1 MB
- Binary files (handled by pre-commit's `exclude_types`)

## Exit codes

| Code | Meaning |
|---|---|
| 0 | No secrets detected — commit proceeds |
| 1 | One or more secrets detected — commit blocked |
| 2 | Internal error (file unreadable, etc.) |

## License

MIT
