Security by Design: Keeping API Tokens Out of Git with a 3-Layer Setup

A developer outlines a three-layer Git defense to prevent API tokens from being committed: .gitignore, a tracked pre-commit secret scan, and environment variables.

The pre-commit hook inspects staged files for AWS keys, GitHub tokens, and private keys, then blocks the commit with a non-zero exit code if it finds a match.

The hook is shared via a configured hooks path, making the protection consistent across the team instead of relying on local setup alone.

The article also shows Node.js env-file support for loading secrets locally, and a test leak is caught before commit.