Catchenv secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked or anywhere in the history. Your real values, not patterns.

Hi Product Hunt, I'm Sergii. omerta is a free, open-source CLI and pre-commit hook that answers one question: is any value from my .env in git?

Secret scanners such as gitleaks and TruffleHog look for strings shaped like keys. Many secrets have no shape: a smaller provider's API key, a storage bucket's name, an organisation ID, a database password. And a key that does leak often turns up encoded, inside a URL or a recorded test fixture.

omerta takes the other route. It reads the values of your env files and searches git for exactly those, as written and as encoded in URLs, JSON and base64:

• omerta check: the staged changes, as a pre-commit hook

• omerta check --all: every tracked file

• omerta history: every commit, tag and commit message

It reports the file, the line and the variable's name, never the value. A committed .env counts as a leak in itself.

Fully offline. Fast (with hyperscan).

With uv installed, try it in any repository:

uvx omerta check --all

uvx omerta history

It runs with pre-commit, Husky, Lefthook or GitHub Actions, on Linux, macOS and Windows, under the MIT licence.

I'd value your feedback!

searching for the real values instead of key-shaped strings makes alot of sense, a db password never looks like a secret to a regex

once i rotate a key, does omerta history still catch the old value sitting in an old commit, or only what's in the current .env??? and how do you deal with short values like a port number, does it get noisy???