detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.

I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.

To reproduce:

  1. Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.
  2. Create/recreate a secrets baseline with detect-secrets scan > .secrets.baseline
  3. Resave the baseline file as UTF-8, because I'm on Windows.
  4. Run detect-secrets audit .secrets.baseline and accept that the secret is okay to be in the file. The segment of the baseline file looks like:
"results": {
    "xyz\\dev_local_settings.py": [
        "type": "Secret Keyword",
        "filename": "xyz\\dev_local_settings.py",
        "hashed_secret": "62f4d1d18d106c8e6f3c79df832893f4b6e95c8e",
        "is_verified": false,
        "line_number": 26,
        "is_secret": false
  1. Have a pre-commit config that looks like this:
-   repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    -   id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package.lock.json
  1. Attempt to git commit -a.

The pre-commit check will fail on the one known secret:

Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

ERROR: Potential secrets about to be committed to git repo!

Secret Type: Secret Keyword
Location:    xyz/dev_local_settings.py:26
  1. Another run of detect-secrets audit .secrets.baseline yields "Nothing to audit!"

Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.