OPEN LINK ↗
// 1h agoOPENSOURCE RELEASE
Omerta Blocks Real .env Secrets Before Git
Omerta is an open-source CLI and pre-commit hook that checks staged files, tracked content, filenames, and Git history for actual values copied from local `.env` files. It also detects URL-, JSON-, and base64-encoded forms while keeping scans offline and never printing secrets.
// ANALYSIS
Omerta targets the blind spot in pattern-based secret scanners: credentials that look like ordinary strings. Its value-based approach is especially useful for AI-generated code and fixtures, where secrets can surface in unexpected formats.
- –Scans staged changes, tracked files, commit history, tags, messages, and filenames
- –Catches arbitrary secrets such as passwords, bucket names, and organization IDs—not just recognizable API-key patterns
- –Runs fully offline and reports variable names and locations without exposing secret values
- –Integrates with pre-commit, Husky, Lefthook, Git hooks, and CI through `uvx`
- –May need careful ignore rules because ordinary environment values can also trigger findings
// TAGS
omertasecurityclidevtoolopen-sourceci-cdautomation
DISCOVERED
1h ago
2026-10-26
PUBLISHED
7h ago
2026-10-26
RELEVANCE
6/ 10
AUTHOR
Sergii Shcherbak
