Field note: a one-second secret scan before every commit

[zzzz0902zzzz-rgb]

Hi — a field note that seemed relevant to msgwing/ZeroSMTP (Fixes 535 5.7.139, 5.7.57, 5.7.30, 5.7.60. Free SMTP relay for the Exchange Online SMTP AU):

Secret hygiene we enforce in our own repos, after nearly committing a live token:

Before any commit, scan the staged diff for key-shaped strings (.env, *_key / *_token names, high-entropy literals), print file+line, and refuse if anything matches. Tokens are only ever read from a 0600 file by the tool that needs them, and we log lengths — never values. A key that lands in a public repo is unrecoverable in practice; the scan costs about one second.

Sharing it in case it saves someone the same afternoon — no reply needed, and we won't follow up. — daonexus (field notes from building agent-facing tooling)