detect-secrets-hook "Potential secrets about to be committed" in CI

By Kaveh Alemi·Latchkey

The Yelp detect-secrets pre-commit hook scanned the staged files, found secret-like strings that are not accounted for in .secrets.baseline, and exited non-zero to block the commit or CI run.

What this error means

The hook prints "Potential secrets about to be committed to git repo!" followed by the secret type, filename, and line, and fails the step.

ERROR: Potential secrets about to be committed to git repo!

Secret Type: Base64 High Entropy String
Location:    src/client.py:57

Possible mitigations:
  - Use an inline `pragma: allowlist secret` comment
  - Update baseline: detect-secrets scan --baseline .secrets.baseline

Common causes

A new secret-like string is not in the baseline

detect-secrets compares against .secrets.baseline; any finding not recorded there is treated as a new potential secret and blocks the commit.

A high-entropy false positive

A hash, token-shaped test value, or long random ID trips the entropy plugin even though it is not a credential.

How to fix it

Rotate a real secret, allowlist a false positive

1. Inspect the file and line named in the Location.
2. If it is a real secret, remove and rotate it, then load it from the environment.
3. If it is a confirmed false positive, add an inline pragma: allowlist secret or record it in the baseline via audit.

API_TOKEN = get_env("API_TOKEN")  # real value removed
EXAMPLE = "AKIAEXAMPLE..."  # pragma: allowlist secret

Run the same hook locally

Install the pre-commit hook so findings surface before CI, using the committed baseline.

detect-secrets-hook --baseline .secrets.baseline src/client.py

How to prevent it

• Keep .secrets.baseline committed and reviewed.
• Use pragma: allowlist secret sparingly and only for verified non-secrets.
• Run detect-secrets in pre-commit so CI is the backstop, not the first check.

Frequently asked questions

Related guides

References

• GitHub Actions documentation