detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.

I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.

To reproduce:

  1. Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.
  2. Create/recreate a secrets baseline with detect-secrets scan > .secrets.baseline
  3. Resave the baseline file as UTF-8, because I'm on Windows.
  4. Run detect-secrets audit .secrets.baseline and accept that the secret is okay to be in the file. The segment of the baseline file looks like:
"results": {
    "xyz\\dev_local_settings.py": [
        "type": "Secret Keyword",
        "filename": "xyz\\dev_local_settings.py",
        "hashed_secret": "62f4d1d18d106c8e6f3c79df832893f4b6e95c8e",
        "is_verified": false,
        "line_number": 26,
        "is_secret": false
  1. Have a pre-commit config that looks like this:
-   repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    -   id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package.lock.json
  1. Attempt to git commit -a.

The pre-commit check will fail on the one known secret:

Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

ERROR: Potential secrets about to be committed to git repo!

Secret Type: Secret Keyword
Location:    xyz/dev_local_settings.py:26
  1. Another run of detect-secrets audit .secrets.baseline yields "Nothing to audit!"

Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.

  • did you resolve your issue? I'm having the exact same issue. Commented Mar 13 at 7:42

1 Answer 1


I resolved the issue by adding a comment containing pragma: allowlist secret in the offending line.

I didn't try it at first, because the issue was in an appsettings.json file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow // comments in appsettings.json.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.