Keys in commits and pushes
When an agent commits, Rollcage reads the staged changes, including what git add . && git commit and git commit -a are about to pick up. When it pushes, Rollcage reads every commit the push would send that no remote has yet. Only added lines are checked.
It blocks real-looking keys from Anthropic, OpenAI, AWS, GitHub, Stripe, Google, Slack, npm, SendGrid and Resend, private keys, database URLs with a password, and secret files such as .env or *.pem. The agent is told which file to fix and that the key should be rotated. The key itself is never repeated, in the message or in the log.
| The agent tries | Rollcage | Why |
|---|---|---|
git add . && git commit -m wip with a Stripe key in pay.js | Blocked | Key in the commit |
git push with an AWS key in an earlier commit | Blocked | Key in what the push sends |
git commit with .env staged | Blocked | Secret file |
git push origin main | Asks you | Protected branch |
gh repo delete me/app | Asks you | Deletes a repository |
aws ec2 terminate-instances … | Asks you | Deletes cloud resources |
curl -X DELETE https://api.vercel.com/… | Asks you | DELETE on a remote API |
psql postgres://…@db.prod.example.com/app | Asks you | Remote database |
curl -X DELETE http://localhost:3000/… | Allowed | Your own Mac |
Protected branches
Pushes to main, master, production, prod and release ask first by default, whether the agent names the branch or just runs git push on it. Change the list in Guard › Leaks and production, or turn it off.
Cloud and databases
Rules cover deletes through the AWS, Google Cloud and Azure command-line tools, Fly, Heroku, Railway, Vercel, Netlify, Supabase, Neon, PlanetScale, DigitalOcean, Firebase, Cloudflare Wrangler, Helm and gh. They also cover any DELETE request or GraphQL delete mutation sent to a remote API, and database clients pointed at a host that isn't on your Mac. Each rule can ask or block.
Keys saved by “always allow”
Claude Code saves the commands you approve with “always allow” in each project's .claude/settings.local.json, keys and all, and that folder is easy to publish by accident. The secrets leak scan now checks those files in your protected projects.
Like the rest of the Guard, these checks see the commands an agent runs through its tools. Codex and Gemini CLI can't pause for approval, so they get a block where other agents are asked. If the check itself fails or takes more than a few seconds, the command goes ahead, so a broken check never stops your work.
Questions
Does it slow down commits?
Only commands that commit or push are checked. The check reads git directly and usually takes well under a second.
What if I really do want to push to main?
Approve it when Claude Code or Cursor asks, or take main off the protected branches in Rollcage › Guard.
Does it replace a pre-commit secret scanner?
It covers commits an agent makes, in every repository, with no setup. A pre-commit hook in the repository also covers the commits you make yourself, so the two work well together.