push-sentinel scans staged changes before every push and warns if it detects secrets such as API keys, tokens, or private keys. Zero config. Zero dependencies. Installs in one command.