Security Check Rules

Before committing or pushing code, must check for sensitive information, especially API Keys and access tokens.

What to Check

API Keys and Access Tokens

• API Keys starting with sk- (OpenAI, Anthropic, Alibaba Cloud, etc.)
• Google API Keys starting with AIzaSy
• Public keys starting with pk_
• Other common API token formats

Before Commit

Run Check First

Run bash .claude/skills/security-check/scripts/security_check.sh commit to check the staging area for sensitive information. If it does NOT output staging area is clear, sensitive information was found.