Pre-commit secret scanner for leaking .env files

What to build

A lightweight CLI and pre-commit hook that scans staged changes and commit history for leaked .env secrets, API keys, and tokens, paired with a GitHub Action and a simple team dashboard for alerts — aimed at solo developers and small teams without enterprise secret-scanning setups.

Solo devs and small teams keep leaking secrets into git because existing secret-scanning tools are either enterprise-grade and costly, or CLI-only with no team visibility — there's room for a simple, affordable hook-plus-dashboard combo.

Demand

Solo developers and small teams shipping fast with AI tools are the ones most likely to accidentally commit .env files and API keys, and they want a drop-in safeguard without adopting enterprise security infrastructure.

• Product HuntLaunch

  Product Hunt listing for omerta: 'Catch .env secrets leaking into git' — launched with discussion thread.

Stack

• Node.js or Go CLI
• Husky or native git hooks
• GitHub Actions API
• Regex/entropy-based secret detection (gitleaks rules as reference)
• Supabase (dashboard + alert storage)
• Next.js (team dashboard UI)

Solo + AI difficulty

Easy to get a basic regex-based scanner and pre-commit hook working in days; the GitHub Action wrapper is also quick. Harder parts are tuning detection to avoid false positives/negatives and building trust for repo access. Rough MVP: 1-2 weeks; dashboard adds another 1-2 weeks.

Entry threshold

Low barrier to build a regex/entropy-based scanner as a CLI or pre-commit hook in a few days; the real challenge is standing out against established free tools like gitleaks and GitHub's native secret scanning.

Window

ongoing, no specific trigger event

Where to find first users

• Product Hunt launch
• r/devops and r/webdev
• Indie Hackers community
• GitHub Marketplace listing for the Action

Competitors

• gitleaks
• trufflehog
• git-secrets
• GitHub Advanced Security secret scanning

Counter-signals & risks

• Mature, widely-adopted free tools already exist in this space (gitleaks, trufflehog, git-secrets, GitHub's native secret scanning and push protection), raising the bar for differentiation.

• Low opportunity score (0.45) and no historical match suggest limited validated signal strength or market pull.

• Secret-scanning tools require deep repo and credential-adjacent access, creating liability/trust risk that may deter adoption without strong security credibility.