The Friday Evening That Costs $10,000

It's 6:47 PM on a Friday. You've been debugging a gnarly AWS SDK integration all week and you finally got it working. Tests pass. The feature is done. You commit, push, open a PR — and head out for the weekend feeling great.

By Saturday morning, your AWS bill shows $9,847 in unexpected charges.

What happened? In the heat of the moment, you left your AWS access keys hardcoded in a config file:

# config.py  ← committed to a public repo
AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

Within minutes of your push, bots that continuously scan GitHub for leaked credentials found your keys. They spun up hundreds of EC2 instances for crypto mining. By the time you checked your phone Saturday morning, the damage was done.

This isn't a hypothetical. It happens every single day to developers at all experience levels.

---

The Problem: Our Brains Are Not Good Linters

We're good at solving complex architectural problems. We're not good at catching the small, repetitive, easy-to-miss mistakes like:

• Hardcoded API keys and credentials
• console.log or fmt.Println debug statements left in production code
• TODO comments that were never resolved
• Accidentally staging .env files

The solution isn't to "be more careful." Humans are fallible. Automation is not.

---

Enter: Git Pre-Commit Hooks

Git hooks are scripts that run automatically at certain points in the git workflow. The pre-commit hook runs before a commit is recorded — giving you the perfect checkpoint to catch problems.

Here's a simple but powerful pre-commit hook that scans for common secrets:

#!/bin/bash
.git/hooks/pre-commit
Make it executable: chmod +x .git/hooks/pre-commit

echo "Running pre-commit security checks..."

--- 1. Detect hardcoded AWS keys ---
PATTERNS=(
  "AKIA[0-9A-Z]{16}"                          # AWS Access Key ID
  "aws_secret_access_key\s=\s['\"A-Za-z0-9/+]+"  # AWS Secret
  "-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY-----"    # Private keys
  "ghp_[a-zA-Z0-9]{36}"                         # GitHub Personal Token
  "sk-[a-zA-Z0-9]{48}"                           # OpenAI API Key
)

STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)

for FILE in $STAGED_FILES; do
for PATTERN in "${PATTERNS[@]}"; do
if grep -qE "$PATTERN" "$FILE" 2>/dev/null; then
echo ""
echo "  BLOCKED: Potential secret detected in $FILE"
echo "  Pattern matched: $PATTERN"
echo ""
echo "  Remove the secret and use environment variables instead."
echo "  Commit aborted."
exit 1
fi
done
done

--- 2. Warn about debug statements ---
DEBUG_PATTERNS=("console\.log(" "fmt\.Println(" "print(" "debugger;")
WARNING=0

for FILE in $STAGED_FILES; do
for PATTERN in "${DEBUG_PATTERNS[@]}"; do
COUNT=$(grep -cE "$PATTERN" "$FILE" 2>/dev/null || echo 0)
if [ "$COUNT" -gt 0 ]; then
echo "  WARNING: $COUNT debug statement(s) found in $FILE ($PATTERN)"
WARNING=1
fi
done
done

if [ "$WARNING" -eq 1 ]; then
echo ""
read -p "  Debug statements found. Commit anyway? [y/N] " REPLY
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 1
fi
fi

echo "Pre-commit checks passed."
exit 0

---

Installing the Hook

The .git/hooks/ directory is local-only and not committed. For team-wide enforcement, use a tool like pre-commit (Python) or Husky (Node.js) which stores hooks in your repository:

Option A: pre-commit (language-agnostic)

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-aws-credentials
      - id: detect-private-key
      - id: check-added-large-files
        args: ['--maxkb=500']
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

Install and activate:

pip install pre-commit
pre-commit install

Option B: Husky (Node.js projects)

npm install --save-dev husky lint-staged
npx husky install
npx husky add .husky/pre-commit "npx lint-staged"

---

The Bigger Picture: Defense in Depth

Pre-commit hooks are your first line of defense. Layer them with:

Layer	Tool	What it catches
Local (pre-commit)	Husky / pre-commit	Secrets, lint errors, debug code
CI Pipeline	GitHub Actions + gitleaks	Anything that slipped through locally
Repository Scanning	GitHub Secret Scanning	Committed secrets (retroactive)
Cloud Provider	AWS Trusted Advisor	Exposed key activity alerts

---

What to Do If You've Already Leaked a Key

1. Revoke immediately — Go to AWS IAM / GitHub Settings and delete the key. Do not rotate — delete.
2. Assume compromise — Audit CloudTrail logs for unauthorized activity.
3. Purge git history — Use git filter-repo or BFG Repo Cleaner. A commit history wipe is not sufficient if the repo is public — GitHub caches blobs.
4. Notify your security team — Even if you caught it fast.

---

A 5-Minute Setup That Saves Thousands

The total time to add a pre-commit hook to your project is under five minutes. The first time it blocks a secret from being committed, it will have paid for itself thousands of times over.

Your future self — and your finance team — will thank you.

Stop relying on memory. Automate the boring, critical stuff. Let your brain focus on the problems only you can solve.

---

Have a close call of your own? Share it in the comments — the more developers hear these stories, the safer our collective codebases become.