trufflehog pre-commit hook scans web/node_modules #14

New issue

Open

opened 2026-05-23 20:55:22 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:55:22 +00:00

Owner

Originally filed by @coilysiren on 2026-05-21T08:57:29Z - https://github.com/coilysiren/repo-recall/issues/232

Symptom

The trufflehog pre-commit hook scans web/node_modules/ and fails on benign example URIs and README tokens shipped inside @types/node and json5. It surfaced while committing #228 right after make web-install populated web/node_modules/ - 11 unverified results, 94 MB / 9349 chunks scanned, all from third-party node deps.

Why it matters

node_modules is gitignored, so nothing from it can ever be committed. Scanning it is pure noise: it slows the hook and the false positives train operators to ignore trufflehog output. Workaround today is rm -rf web/node_modules before every commit, which is silly.

Fix

Scope the trufflehog hook to tracked / staged files, or add an exclude for node_modules/ (and likely dist/, target/). Check .pre-commit-config.yaml for the hook's args / exclude pattern.

_Originally filed by @coilysiren on 2026-05-21T08:57:29Z - [https://github.com/coilysiren/repo-recall/issues/232](https://github.com/coilysiren/repo-recall/issues/232)_ **Symptom** The `trufflehog` pre-commit hook scans `web/node_modules/` and fails on benign example URIs and README tokens shipped inside `@types/node` and `json5`. It surfaced while committing #228 right after `make web-install` populated `web/node_modules/` - 11 unverified results, 94 MB / 9349 chunks scanned, all from third-party node deps. **Why it matters** `node_modules` is gitignored, so nothing from it can ever be committed. Scanning it is pure noise: it slows the hook and the false positives train operators to ignore trufflehog output. Workaround today is `rm -rf web/node_modules` before every commit, which is silly. **Fix** Scope the trufflehog hook to tracked / staged files, or add an exclude for `node_modules/` (and likely `dist/`, `target/`). Check `.pre-commit-config.yaml` for the hook's `args` / `exclude` pattern.

coilysiren added the

label

2026-05-31 01:55:06 +00:00

coilysiren added

and removed

labels

2026-05-31 07:01:19 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-flight-deck/repo-recall#14

No description provided.

Rows
Columns