Metadata-Version: 2.4
Name: omerta
Version: 0.1.1
Summary: Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked or anywhere in the history. Your real values, not patterns.
Keywords: secrets,env,dotenv,.env,git,pre-commit,leak,api-key,security,secret-scanning
Author: Sergii Shcherbak
Author-email: Sergii Shcherbak <sergii@shcherbak.ai>
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Classifier: Operating System :: POSIX :: Linux
Classifier: Operating System :: MacOS
Classifier: Operating System :: Microsoft :: Windows
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Version Control :: Git
Classifier: Environment :: Console
Classifier: Typing :: Typed
Requires-Dist: hyperscan==0.9.1
Requires-Dist: python-dotenv==1.2.4
Requires-Python: >=3.11
Project-URL: Homepage, https://github.com/shcherbak-ai/omerta
Project-URL: Repository, https://github.com/shcherbak-ai/omerta
Project-URL: Issues, https://github.com/shcherbak-ai/omerta/issues
Project-URL: Changelog, https://github.com/shcherbak-ai/omerta/blob/main/CHANGELOG.md
Description-Content-Type: text/markdown

# omerta

Catch `.env` secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked or anywhere in the history.

```bash
uvx omerta check --all    # every tracked file
uvx omerta history        # every commit, tag and message
```

- Matches your actual values, as written and as encoded in URLs, JSON and base64, so it catches secrets of any format; it complements pattern scanners, which find what looks like a key.
- Reports the file, the line and the variable's name, never the value; a tracked env file is a leak in itself.
- Runs entirely offline.

As a pre-commit hook:

```yaml
repos:
  - repo: https://github.com/shcherbak-ai/omerta
    rev: v0.1.1
    hooks:
      - id: omerta
```

With Husky, Lefthook or a plain git hook: `uvx omerta@0.1.1 check`.

See the [repository](https://github.com/shcherbak-ai/omerta#readme) for the options, CI and configuration.

Licensed under [MIT](https://github.com/shcherbak-ai/omerta/blob/main/LICENSE).
