<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Pre-Commit Security Hooks — API Reference

## pre-commit CLI

```bash
# Install hooks
pre-commit install --install-hooks

# Run all hooks
pre-commit run --all-files

# Run specific hook
pre-commit run gitleaks --all-files

# Update hook versions
pre-commit autoupdate

# Uninstall hooks
pre-commit uninstall
```

## Gitleaks CLI

```bash
# Scan repository
gitleaks detect --source . --report-format json --report-path gitleaks.json

# Scan specific commits
gitleaks detect --source . --log-opts="HEAD~10..HEAD"

# Protect (pre-commit mode)
gitleaks protect --staged --report-format json

# Custom config
gitleaks detect --config .gitleaks.toml --source .
```

## detect-secrets CLI

```bash
# Generate baseline
detect-secrets scan > .secrets.baseline

# Audit baseline
detect-secrets audit .secrets.baseline

# Update baseline
detect-secrets scan --update .secrets.baseline

# Scan with plugins
detect-secrets scan --list-all-plugins
detect-secrets scan --disable-plugin KeywordDetector
```

## Common Hook IDs

| Hook | Source | Purpose |
|------|--------|---------|
| `gitleaks` | gitleaks/gitleaks | Secret detection |
| `detect-secrets` | Yelp/detect-secrets | Secret baseline |
| `detect-private-key` | pre-commit-hooks | Private key files |
| `bandit` | PyCQA/bandit | Python security |
| `check-added-large-files` | pre-commit-hooks | Binary bloat |
| `check-merge-conflict` | pre-commit-hooks | Conflict markers |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All hooks passed |
| 1 | Hook findings detected |
