Catchenv secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked or anywhere in the history. Your real values, not patterns.
Hi Product Hunt, I'm Sergii. omerta is a free, open-source CLI and pre-commit hook that answers one question: is any value from my .env in git?
Secret scanners such as gitleaks and TruffleHog look for strings shaped like keys. Many secrets have no shape: a smaller provider's API key, a storage bucket's name, an organisation ID, a database password. And a key that does leak often turns up encoded, inside a URL or a recorded test fixture.
omerta takes the other route. It reads the values of your env files and searches git for exactly those, as written and as encoded in URLs, JSON and base64:
• omerta check: the staged changes, as a pre-commit hook
• omerta check --all: every tracked file
• omerta history: every commit, tag and commit message
It reports the file, the line and the variable's name, never the value. A committed .env counts as a leak in itself.
Fully offline. Fast (with hyperscan).
With uv installed, try it in any repository:
uvx omerta check --all
uvx omerta history
It runs with pre-commit, Husky, Lefthook or GitHub Actions, on Linux, macOS and Windows, under the MIT licence.
Searching for the repository's actual secret values is a strong complement to pattern scanners. I'd add one explicit negative test for output safety: inject a known canary secret, fail every mode, and assert the canary never appears in stdout, stderr, SARIF, or CI annotations. The scanner's own evidence path is part of the threat model.
The distinction between searching for your actual values and searching for key-shaped patterns is the part that stands out to me. A database password or a smaller provider key often has no recognizable shape, and the fact that omerta also checks encoded forms in URLs, JSON, and base64 covers the ways a leak usually hides. Reporting the file, line, and variable name without printing the value is the right call too — a checker that copies a secret into a log would just create a second cleanup.
reporting the variable name without printing its value is a good detail
a secret checker that accidentally copies the secret into a ci log would leave u with another cleanup job
Reporting the variable name without printing its value is a good call. A failed check needs to be safe to paste into a ticket.
searching for the real values instead of key-shaped strings makes alot of sense, a db password never looks like a secret to a regex
once i rotate a key, does omerta history still catch the old value sitting in an old commit, or only what's in the current .env??? and how do you deal with short values like a port number, does it get noisy???
About omerta on Product Hunt
“Catch .env secrets leaking into git”
omerta launched on Product Hunt on October 26th, 2026 and earned 86 upvotes and 7 comments, placing #16 on the daily leaderboard. Catchenv secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked or anywhere in the history. Your real values, not patterns.
omerta was featured in Open Source (69k followers), Developer Tools (521.9k followers) and GitHub (41.5k followers) on Product Hunt. Together, these topics include over 140.3k products, making this a competitive space to launch in.
Who hunted omerta?
omerta was hunted by Sergii Shcherbak. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how omerta stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Sergii Shcherbak
Hi Product Hunt, I'm Sergii. omerta is a free, open-source CLI and pre-commit hook that answers one question: is any value from my .env in git?
Secret scanners such as gitleaks and TruffleHog look for strings shaped like keys. Many secrets have no shape: a smaller provider's API key, a storage bucket's name, an organisation ID, a database password. And a key that does leak often turns up encoded, inside a URL or a recorded test fixture.
omerta takes the other route. It reads the values of your env files and searches git for exactly those, as written and as encoded in URLs, JSON and base64:
• omerta check: the staged changes, as a pre-commit hook
• omerta check --all: every tracked file
• omerta history: every commit, tag and commit message
It reports the file, the line and the variable's name, never the value. A committed .env counts as a leak in itself.
Fully offline. Fast (with hyperscan).
With uv installed, try it in any repository:
uvx omerta check --all
uvx omerta history
It runs with pre-commit, Husky, Lefthook or GitHub Actions, on Linux, macOS and Windows, under the MIT licence.
I'd value your feedback!