fix(security): scope TruffleHog hook to staged files only#35
Conversation
Replace `trufflehog git file://. --since-commit HEAD` with a staged-files scan via `git diff --cached | xargs trufflehog filesystem`. The git-history mode also traverses fetched remote branches in the local object store, which produces false positives from placeholder credentials in unmerged branches. See `.claude/rules/pre-commit.md` invariant `PC-HOOK-STAGED-SCOPE` for the general principle (pre-commit hooks must scope to staged files only; full-history scanning belongs in CI). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
1 participant
Summary
Replace
trufflehog git file://. --since-commit HEADwith a staged-files form.Why
Resolves observation #4 from the skill observation log; part of the fleet-wide
TruffleHog rollout. See
.claude/rules/pre-commit.mdPC-HOOK-STAGED-SCOPE.Generated with Claude Code