[claude-hackernews] Reply draft: Git Shield Show HN, in-loop vs commit-time gate (id=47972142)#36
Open
NiveditJain wants to merge 1 commit into
Open
[claude-hackernews] Reply draft: Git Shield Show HN, in-loop vs commit-time gate (id=47972142)#36NiveditJain wants to merge 1 commit into
NiveditJain wants to merge 1 commit into
Conversation
… gate (id=47972142)
📝 WalkthroughWalkthroughA single Markdown draft file is added to document a prepared reply to a Hacker News post about Git Shield, a tool for preventing secrets and PII leakage via local git hooks. The draft includes story metadata, a synopsis, a proposed reply, team insights, and formatting notes. ChangesDraft HN Reply
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Review rate limit: 3/5 reviews remaining, refill in 15 minutes and 14 seconds. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@drafts/2026-05-03T171302Z.md`:
- Around line 15-19: The fenced reply block is missing a language tag causing
MD040; update the fenced block around the disclosure text to use a language
identifier (use "text") by changing the opening triple backticks to "```text" so
the block is recognized as plain text (locate the fenced reply block starting
with the disclosure line and modify its opening fence accordingly).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: da5909f0-8967-478f-b1d1-cd302e8b6acd
📒 Files selected for processing (1)
drafts/2026-05-03T171302Z.md
Comment on lines
+15
to
+19
| ``` | ||
| (disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai) | ||
|
|
||
| The two-stage split (cheap secret pass at commit, heavier PII pass at push) is a reasonable budget allocation. Worth thinking about a third gate earlier in the loop: an agent-side PreToolUse hook that fires before the write happens, not after the diff lands. The layers are complementary, not redundant. Git-time scanning sees real diffs (ground truth) and catches what was actually committed; agent-side scanning sees the tool inputs (e.g., the read of ~/.env that's about to land in a test fixture) and can deny the write before the file exists. We have a `protect-env-vars` policy for the env-vars-into-outputs case; gitleaks would still catch what slips through it. Different latencies, different failure modes. | ||
| ``` |
There was a problem hiding this comment.
Add a language tag to the fenced reply block.
The code fence is missing a language identifier, which triggers MD040. Use text for this reply block.
Suggested patch
-```
+```text
(disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai)
@@
-```
+```🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 15-15: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@drafts/2026-05-03T171302Z.md` around lines 15 - 19, The fenced reply block is
missing a language tag causing MD040; update the fenced block around the
disclosure text to use a language identifier (use "text") by changing the
opening triple backticks to "```text" so the block is recognized as plain text
(locate the fenced reply block starting with the disclosure line and modify its
opening fence accordingly).
This was referenced May 3, 2026
Open
[claude-hackernews] Reply draft: $38k Bedrock runaway, LLM-call vs tool-call layer (id=47933355)
#43
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PreToolUsehook that fires before the write happens, not after the diff lands), names the failure modes each layer catches differently (real diffs vs tool inputs), and references one policy by name (protect-env-vars) tied to OP's specific test-fixture leak example.https://hn.algolia.com/?q=show+HN+hooks&dateRange=pastMonth&type=story(Show HN cluster on hooks-based tooling); cross-checked the prod-DB / agent-deleted-DB cluster onhttps://hn.algolia.com/?q=claude+code+deleted&dateRange=pastWeek&type=commentfor fresher candidates and confirmed Git Shield was uncovered. Draft on the working branch only - no other write.Draft file: drafts/2026-05-03T171302Z.md
Thread: https://news.ycombinator.com/item?id=47972142
Repo OP linked: https://github.com/vekexasia/git-shield
Test plan
Length and shaperules inINSTRUCTIONS.md: leading disclosure line, single substantive paragraph, exactly one policy name, body under ~150 words, repo URL appears once. Body is ~135 words by my count.Summary by CodeRabbit