Rules and a pre-commit hook to catch placeholders and secrets in AI-written code

Vibe coding securely: placeholders and secrets

Rules to add to your agent's instruction file (AGENTS.md, CLAUDE.md, or your rules file), plus a pre-commit hook that enforces them. The rules guide the agent. The hook catches what slips through.

1. Add these rules to your agent's instruction file

Placeholders

• Never ship incomplete code or skip a security check
• If you can't complete a security check, deny access by default and tell me
• Never leave TODO or FIXME comments in authentication, authorization, payment, or access control code
• Never write a function that returns true or skips validation as a temporary stand-in

Secrets

• Read secrets only from environment variables
• Never write a key, token, or password into code, config files, or tests
• Never put secrets or privileged API keys in frontend code
• When a new secret is needed, add a placeholder to .env.example and tell me

2. Add a pre-commit hook

Save as .git/hooks/pre-commit and make it executable with chmod +x .git/hooks/pre-commit. Adjust SENSITIVE_PATHS to match your repo.

#!/usr/bin/env bash
set -euo pipefail

# Paths that hold security-sensitive code. Adjust for your repo.
SENSITIVE_PATHS='auth|payment|billing|permission|access'

# Common secret patterns. A backstop, not a replacement for a dedicated secret scanner.
SECRET_PATTERN="AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|(api[_-]?key|secret|token|passw(or)?d)[[:space:]]*[:=][[:space:]]*[\"'][^\"']{8,}"

fail=0
staged=$(git diff --cached --name-only --diff-filter=ACM)

# 1. Block .env files (allows .env.example)
if echo "$staged" | grep -E '(^|/)\.env(\..+)?
  
  




 | grep -vq '\.example
  
  




; then
  echo "Blocked: a .env file is staged. Add it to .gitignore."
  fail=1
fi

# 2. Block placeholders in security-sensitive files
sensitive=$(echo "$staged" | grep -Ei "$SENSITIVE_PATHS" || true)
if [ -n "$sensitive" ]; then
  if git diff --cached -U0 -- $sensitive | grep -E '^\+[^+]' \
     | grep -Ei 'TODO|FIXME|return[[:space:]]+true[[:space:]]*;?[[:space:]]*
  
  




; then
    echo "Blocked: placeholder or hardcoded return in security-sensitive code."
    fail=1
  fi
fi

# 3. Block likely secrets in any added line
if git diff --cached -U0 | grep -E '^\+[^+]' | grep -Ei -e "$SECRET_PATTERN"; then
  echo "Blocked: possible secret in staged changes."
  fail=1
fi

if [ "$fail" -ne 0 ]; then
  echo "Commit blocked. Fix the issues above. If it's a false positive, adjust the patterns in this hook."
  exit 1
fi

Git hooks are local and aren't shared when someone clones the repo. Run the same checks in CI so they apply to everyone.

3. Add these lines to .gitignore

.env
.env.*
!.env.example

4. If a secret gets committed

1. Rotate it immediately. Deleting it from the code doesn't remove it from git history.
2. Check the provider's logs for any use of the leaked key.
3. Remove it from git history if the repo is shared or public.
4. Add the pattern to your hook so it can't happen again.