Metadata-Version: 2.4
Name: omerta
Version: 0.1.0
Summary: Fail when a value of your env files, e.g. an API key in .env, is in git: staged, tracked, or anywhere in the history
Keywords: secrets,env,dotenv,.env,git,pre-commit,leak,api-key,security,secret-scanning
Author: Sergii Shcherbak
Author-email: Sergii Shcherbak <sergii@shcherbak.ai>
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Classifier: Operating System :: POSIX :: Linux
Classifier: Operating System :: MacOS
Classifier: Operating System :: Microsoft :: Windows
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Version Control :: Git
Classifier: Environment :: Console
Classifier: Typing :: Typed
Requires-Dist: hyperscan==0.9.1
Requires-Dist: python-dotenv==1.2.4
Requires-Python: >=3.11
Project-URL: Homepage, https://github.com/shcherbak-ai/omerta
Project-URL: Repository, https://github.com/shcherbak-ai/omerta
Project-URL: Issues, https://github.com/shcherbak-ai/omerta/issues
Project-URL: Changelog, https://github.com/shcherbak-ai/omerta/blob/main/CHANGELOG.md
Description-Content-Type: text/markdown

# omerta

Fail when a value of your env files, e.g. an API key in `.env`, is in git: in the staged changes, in a tracked file, or anywhere in the history.

```bash
uvx omerta check --all    # every tracked file
uvx omerta history        # every commit, tag and message
```

- Matches your actual values, as written and as encoded in URLs, JSON and base64, so it catches secrets of any format; it complements pattern scanners, which find what looks like a key.
- Reports the file, the line and the variable's name, never the value; a tracked env file is a leak in itself.
- Runs entirely offline.

As a pre-commit hook:

```yaml
repos:
  - repo: https://github.com/shcherbak-ai/omerta
    rev: v0.1.0
    hooks:
      - id: omerta
```

With Husky, Lefthook or a plain git hook: `uvx omerta@0.1.0 check`.

See the [repository](https://github.com/shcherbak-ai/omerta#readme) for the options, CI and configuration.

Licensed under [MIT](https://github.com/shcherbak-ai/omerta/blob/main/LICENSE).
