Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: use word boundaries in AWS key detection to avoid base64 false p…
…ositives
  • Loading branch information
jdalton committed Apr 15, 2026
commit 236273c8a01d8813dcef29a33aff67fa8d808660
6 changes: 3 additions & 3 deletions .git-hooks/pre-push
Original file line number Diff line number Diff line change
Expand Up @@ -168,10 +168,10 @@ while read local_ref local_sha remote_ref remote_sha; do
ERRORS=$((ERRORS + 1))
fi

# AWS keys.
if echo "$file_text" | grep -iqE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})'; then
# AWS keys (word-boundary match to avoid false positives in base64 data).
if echo "$file_text" | grep -iqE '(aws_access_key|aws_secret|\bAKIA[0-9A-Z]{16}\b)'; then
printf "${RED}✗ BLOCKED: Potential AWS credentials found in: %s${NC}\n" "$file"
echo "$file_text" | grep -niE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' | head -3
echo "$file_text" | grep -niE '(aws_access_key|aws_secret|\bAKIA[0-9A-Z]{16}\b)' | head -3
ERRORS=$((ERRORS + 1))
fi

Expand Down
Loading