The Pre-Commit Hooks Worth Installing Today
Secret scan, formatter, linter, large-file guard. Four hooks that prevent the four most common self-inflicted wounds.
The cheapest security and quality work available is the check that runs before a mistake becomes a commit. It costs a second of your time and prevents the class of problem that is expensive precisely because it is embarrassing.
Four hooks cover most of it.
The four
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.21.2
hooks: [{ id: gitleaks }]
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: check-added-large-files
args: ['--maxkb=1024']
- id: check-merge-conflict
- id: end-of-file-fixer
- id: trailing-whitespaceSecret scanning stops the credential commit before it enters history, where it lives forever regardless of what you do next.
Large file guard stops the 40 MB video someone dropped in public/. Once a large binary is in git history, every clone downloads it for the rest of the repository's life.
Merge conflict markers catch the <<<<<<< that otherwise reaches a build.
Formatting removes the diff noise that makes review harder than it needs to be.
Add your linter and your formatter of choice, and that is the setup.
Keep it fast
The rule that determines whether hooks survive: they must run on staged files only, and they must finish in a couple of seconds.
A pre-commit that takes thirty seconds trains everyone to use --no-verify, at which point you have zero hooks and a false sense of having some.
Heavy checks — the full test suite, a complete type check, a deep security scan — belong in CI where they can take their time.
Commit the config
The point is that the whole team gets the same checks, including whoever maintains the project after you. A hook that only exists on your machine is a personal preference, not a standard.
For client handover this matters more than it sounds. The next developer inherits the guardrails, and the standards you set survive without you being there to enforce them.
The one to add if you add nothing else
Secret scanning. Formatting inconsistencies are annoying. A leaked production credential is a phone call on a Sunday.
Resources
- Repo: pre-commit/pre-commit
- Hook index: pre-commit.com/hooks
- Video walkthroughs: YouTube: pre-commit hooks tutorial
- Related: Gitleaks
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
