Before it shows you commit message suggestions, commitdog silently scans your staged diff for credentials and sensitive values. If it finds a match, it blocks the commit and tells you exactly which file and line is the problem — giving you a chance to remove the secret before it reaches your remote.
How it works
commitdog runs the scan automatically as part of the normal commit flow. You don’t need to enable it or run a separate command. The scan happens in the background, and if nothing is found, you’ll never see it — suggestions appear as normal.
When a secret is detected, the commit is blocked and the output shows you the secret type, the file it’s in, and the offending line:
Committing secrets exposes them to anyone with access to your remote repository — and often to the public internet. Once a secret is in your Git history, rotating the credential is not enough; the history must be rewritten to fully remove it. Do not commit secrets.
Committing anyway
If you type y at the prompt, commitdog proceeds with the commit and push. Use this only if you have confirmed the detected value is not a real credential (for example, commitdog flagged a value that your test-exclusion patterns did not catch).
Detected secret types
commitdog checks every added line in your staged diff against the following patterns:
Files and lines that are skipped
commitdog skips files whose names contain any of the following, because these are unlikely to hold real credentials:
_test or test_.test.specfixturemockfake
You can also prevent a specific line from triggering the scanner by including one of these placeholder markers anywhere in the line: placeholder, your_, <your, or changeme. Lines containing these strings are skipped automatically, so documentation examples and configuration templates with placeholder values won’t cause false positives.
+ in the diff). Deleted lines and unchanged context lines are not checked. 