Pre-commit hook

What it means

A pre-commit hook is a script that Git runs automatically just before it records a commit. If the script exits with an error, the commit is stopped. It lives on the developer's own computer, inside the repository's hooks folder, and runs in seconds.

Teams use it to catch cheap problems early: a stray password, a formatting slip, a banned file type. Because it runs before the code ever reaches a shared repository, a mistake is fixed in private instead of being published to the whole team.

Why it matters

The most useful job is stopping secrets from entering history. Once a key is pushed, it must be treated as exposed even if you delete it later, because it stays in the repository's history and in every clone. Stopping it before the commit avoids a rotation.

It also makes good habits the default. Developers get instant feedback on the line they just wrote, which teaches faster than a report weeks later. That supports the idea of shifting left, finding problems where they are cheapest to fix.

How it shows up

Hooks are usually managed with a shared configuration file, so everyone runs the same checks. Typical ones scan for secrets, run a linter, check for large files and block commits straight to the main branch. Keep them fast, or developers will switch them off and the checks will protect nobody.

The key limit is that a hook is optional. Hooks are not copied when someone clones a repository, and a developer can skip them with a flag. So never treat a pre-commit hook as the only control. Repeat the important checks on the server, in the pipeline, where they cannot be bypassed.