Mundi QMD — Secret Scan Pre-Commit

Overview

Prevents secret commits via automated pre-commit hooks. Addresses the root cause of the Twilio SID rsync leak and the legacy config.json exposure: secrets were caught after commit / after push, not before. PF-1 rotated the keys; this skill prevents recurrence.

Uses the existing Mundi secret-regex bundle from ~/.claude/scripts/phase3/check-secrets.sh and wires it into gitleaks (preferred) or trufflehog via the pre-commit framework.

When to use

• Onboarding a new monorepo or app (apps/<new>/ just created)
• A secret just leaked — install the guardrail so it can't happen again
• Auditing an existing repo without pre-commit ("are we protected here?")
• Reviewing / updating the regex bundle as new providers are added

The Mundi secret regex bundle

From ~/.claude/scripts/phase3/check-secrets.sh: