PreToolUse hook blocks Claude Code API key leaks and wrong-repo pushes

Short summary

The author builds a PreToolUse hook for Claude Code's Bash tool that mechanically blocks two accident classes: leaking secrets via git commit and pushing to wrong repositories. The hook uses an early-return regex to avoid taxing non-git commands, blocks bypass flags like --no-verify, scans staged diffs for AWS keys and secret patterns, and enforces a GitHub owner allowlist. Design principles include fail-secure behavior and blocking the agent from disabling its own guardrails.

• •PreToolUse hook on Bash tool catches secrets at commit/push time, not just file-write time
• •Blocks --no-verify and other bypass flags to prevent the agent from circumventing safety gates
• •Enforces a GitHub owner allowlist so pushes to third-party repos are mechanically stopped

Generated with AI, which can make mistakes.