ozan
f01036c646
Merged overlapping posts: - forking-gitea + fork-dont-build → one post about the fork philosophy - fal-image-generation + image-generation-fal → one post about AI art pipeline Rewrote all posts with external/public voice: - Stronger hooks, concrete examples, punchier language - agentic-workflow: restructured around soul files + skills + numbers - agent-harness: clearer framing of 'what an agent harness is' - cloud-harness: tighter narrative about overnight agents - godot-optimisation: same depth, sharper opening - pre-commit-agent: clearer architecture, cost breakdown - studio-cli: reframed around identity/cold-start problem - blog-visual-upgrade: tightened the restyle story 10 posts total (9 markdown + 1 hand-authored HTML)
338 lines
16 KiB
HTML
338 lines
16 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
<title>A Pre-Commit Agent That Guards Your Secrets for $0.001 — Tinqs Blog</title>
|
|
<meta name="description" content="We built a pre-commit hook that calls DeepSeek V4 Flash to review every commit. It catches leaked API keys, classified terms, broken URLs, and drafts announcements — for a tenth of a cent per commit.">
|
|
<meta name="robots" content="index, follow">
|
|
<link rel="canonical" href="https://www.tinqs.com/blog/pre-commit-agent">
|
|
|
|
<meta property="og:type" content="article">
|
|
<meta property="og:url" content="https://www.tinqs.com/blog/pre-commit-agent">
|
|
<meta property="og:title" content="A Pre-Commit Agent That Guards Your Secrets for $0.001">
|
|
<meta property="og:description" content="A DeepSeek-powered pre-commit hook that catches leaks for $0.001/commit.">
|
|
<meta property="og:image" content="https://www.tinqs.com/img/og-cover.jpg">
|
|
|
|
<meta name="twitter:card" content="summary_large_image">
|
|
<meta name="twitter:title" content="A Pre-Commit Agent That Guards Your Secrets for $0.001">
|
|
<meta name="twitter:description" content="A DeepSeek-powered pre-commit hook that catches leaks for $0.001/commit.">
|
|
<meta name="twitter:image" content="https://www.tinqs.com/img/og-cover.jpg">
|
|
|
|
<script type="application/ld+json">
|
|
{
|
|
"@context": "https://schema.org",
|
|
"@type": "BlogPosting",
|
|
"headline": "A Pre-Commit Agent That Guards Your Secrets for $0.001",
|
|
"datePublished": "2026-05-25",
|
|
"author": {
|
|
"@type": "Person",
|
|
"name": "Ozan Bozkurt"
|
|
},
|
|
"publisher": {
|
|
"@type": "Organization",
|
|
"name": "Tinqs Limited",
|
|
"url": "https://www.tinqs.com"
|
|
},
|
|
"description": "We built a pre-commit hook that calls DeepSeek V4 Flash to review every commit. It catches leaked API keys, classified terms, broken URLs, and drafts announcements — for a tenth of a cent per commit."
|
|
}
|
|
</script>
|
|
|
|
<!-- PostHog (EU) -->
|
|
<script>
|
|
!function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture register register_once register_for_session unregister unregister_for_session getFeatureFlag getFeatureFlagPayload isFeatureEnabled reloadFeatureFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSessionId getSurveys getActiveMatchingSurveys renderSurvey canRenderSurvey getNextSurveyStep identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException loadToolbar get_property getSessionProperty createPersonProfile opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing clear_opt_in_out_capturing debug".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);
|
|
posthog.init('phc_teG6p5oxf6poQHPThq5AGKzWQNhw4bHW9arLwWAVXm3f',{api_host:'https://eu.i.posthog.com',ui_host:'https://eu.posthog.com',person_profiles:'identified_only',defaults:'2026-01-30'})
|
|
</script>
|
|
|
|
<link rel="icon" type="image/svg+xml" href="/img/favicon.svg">
|
|
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
|
<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,500;1,600;1,700&display=swap" rel="stylesheet">
|
|
<link rel="stylesheet" href="../style.css">
|
|
<style>
|
|
/* ── Team guide aesthetic: self-contained overrides ── */
|
|
|
|
/* ── Gradient title (amber → warm gold, hint of blue) ── */
|
|
.post__title {
|
|
background: linear-gradient(90deg, #c9935a, #f59e0b 40%, #38bdf8);
|
|
-webkit-background-clip: text;
|
|
background-clip: text;
|
|
color: transparent;
|
|
font-weight: 800;
|
|
}
|
|
|
|
/* ── Date pill ── */
|
|
.post__date {
|
|
display: inline-block;
|
|
font-family: ui-monospace, 'SF Mono', 'Cascadia Code', Consolas, monospace;
|
|
font-size: 0.72rem;
|
|
letter-spacing: 0.22em;
|
|
text-transform: uppercase;
|
|
color: #38bdf8;
|
|
border: 1px solid rgba(147, 140, 129, 0.25);
|
|
border-radius: 999px;
|
|
padding: 4px 14px;
|
|
margin-bottom: 16px;
|
|
}
|
|
|
|
/* ── Lead ── */
|
|
.post__lead {
|
|
color: #9aa7b4;
|
|
font-size: 1.08rem;
|
|
line-height: 1.7;
|
|
}
|
|
|
|
/* ── H2: left accent bar ── */
|
|
.post__body h2 {
|
|
font-size: 1.7rem;
|
|
margin: 54px 0 6px;
|
|
padding-left: 16px;
|
|
border-left: 4px solid #c9935a;
|
|
}
|
|
|
|
/* ── H3: purple secondary accent ── */
|
|
.post__body h3 {
|
|
color: #a855f7;
|
|
font-size: 1.18rem;
|
|
margin: 30px 0 4px;
|
|
}
|
|
|
|
/* ── Inline code ── */
|
|
.post__body code {
|
|
font-family: ui-monospace, 'SF Mono', 'Cascadia Code', Consolas, monospace;
|
|
font-size: 0.86em;
|
|
background: #1c2230;
|
|
color: #9fe6c0;
|
|
padding: 2px 6px;
|
|
border-radius: 5px;
|
|
border: 1px solid #2a3340;
|
|
}
|
|
|
|
/* ── Code blocks (dark panel) ── */
|
|
.post__body pre {
|
|
background: #0a0e14;
|
|
border: 1px solid #2a3340;
|
|
border-radius: 10px;
|
|
padding: 16px 18px;
|
|
overflow-x: auto;
|
|
margin: 14px 0;
|
|
font-family: ui-monospace, 'SF Mono', 'Cascadia Code', Consolas, monospace;
|
|
font-size: 0.85rem;
|
|
line-height: 1.55;
|
|
color: #e6edf3;
|
|
}
|
|
|
|
/* Reset inline-code double-up inside pre */
|
|
.post__body pre code {
|
|
background: transparent;
|
|
padding: 0;
|
|
border: none;
|
|
font-size: inherit;
|
|
color: inherit;
|
|
border-radius: 0;
|
|
}
|
|
|
|
/* ── Blockquote callout (ready for future use; build.js does not emit blockquote yet) ── */
|
|
.post__body blockquote {
|
|
background: rgba(245, 158, 11, 0.08);
|
|
border: 1px solid rgba(245, 158, 11, 0.25);
|
|
border-left: 4px solid #f59e0b;
|
|
border-radius: 0 12px 12px 0;
|
|
padding: 16px 18px;
|
|
margin: 18px 0;
|
|
color: #f4e3c4;
|
|
font-size: 0.94rem;
|
|
}
|
|
|
|
/* ── Links ── */
|
|
.post__body a {
|
|
color: #38bdf8;
|
|
}
|
|
|
|
.post__body a:hover {
|
|
color: #a855f7;
|
|
}
|
|
|
|
/* ── Strong ── */
|
|
.post__body strong {
|
|
color: #f59e0b;
|
|
}
|
|
|
|
/* ── HR ── */
|
|
.post__body hr {
|
|
border: none;
|
|
border-top: 1px solid #2a3340;
|
|
margin: 32px 0;
|
|
}
|
|
|
|
/* ── Figures ── */
|
|
.post__body figure img {
|
|
border-radius: 12px;
|
|
border: 1px solid #2a3340;
|
|
}
|
|
|
|
.post__body figcaption {
|
|
color: #9aa7b4;
|
|
font-size: 0.85rem;
|
|
margin-top: 6px;
|
|
}
|
|
|
|
/* ── List spacing ── */
|
|
.post__body li {
|
|
margin: 4px 0;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
|
|
<!-- NAV -->
|
|
<nav class="nav nav--scrolled" id="nav">
|
|
<a href="/" class="nav__logo" aria-label="Tinqs home">
|
|
<span class="nav__wordmark">TINQS</span>
|
|
</a>
|
|
<div class="nav__links">
|
|
<a href="/#game" class="nav__link">Games</a>
|
|
<a href="/#tech" class="nav__link">Technology</a>
|
|
<a href="/#about" class="nav__link">About</a>
|
|
<a href="/blog/" class="nav__link" style="color: var(--c-accent-l);">Blog</a>
|
|
<a href="/#signup" class="nav__link">Contact</a>
|
|
<a href="/press" class="nav__link">Press</a>
|
|
</div>
|
|
<button class="nav__burger" aria-label="Open menu" id="navBurger">
|
|
<span></span><span></span><span></span>
|
|
</button>
|
|
</nav>
|
|
|
|
<!-- MOBILE MENU -->
|
|
<div class="mobile-menu" id="mobileMenu">
|
|
<a href="/#game" class="mobile-menu__link">Games</a>
|
|
<a href="/#tech" class="mobile-menu__link">Technology</a>
|
|
<a href="/#about" class="mobile-menu__link">About</a>
|
|
<a href="/blog/" class="mobile-menu__link">Blog</a>
|
|
<a href="/#signup" class="mobile-menu__link">Contact</a>
|
|
<a href="/press" class="mobile-menu__link">Press</a>
|
|
</div>
|
|
|
|
<!-- POST -->
|
|
<article class="post">
|
|
<a href="/blog/" class="post__back">← All Posts</a>
|
|
<span class="post__date">25 May 2026</span>
|
|
<h1 class="post__title">A Pre-Commit Agent That Guards Your Secrets for $0.001</h1>
|
|
<p class="post__lead">Every small team has the same problem: too many things to remember before <code>git commit</code>. Don't leak API keys. Don't reference the classified AI codename in public posts. Don't link to GitHub repos we deleted six months ago. Don't push a blog post with a 90-character title.</p>
|
|
|
|
<div class="post__body">
|
|
<p>A checklist in the README doesn't work. Humans skip checklists. Code review catches some issues but not all — reviewers focus on logic, not whether a URL points to a deleted org.</p>
|
|
<p>We built a pre-commit hook with two layers: a regex blocklist that's instant and free, and an LLM review that costs $0.001. Together they catch everything.</p>
|
|
<h2>Layer 1: Regex blocklist (0ms, $0.00)</h2>
|
|
<p>A text file of patterns, each tagged with scope and message:</p>
|
|
<pre><code>public|\bCosmos\b|Classified codename — use "advanced colonist AI"
|
|
all|github\.com/(tinqs-ltd|tinqs)/|GitHub repos deleted — use tinqs.com
|
|
all|sk-[a-zA-Z0-9]{20,}|Possible API key leaked
|
|
all|AKIA[A-Z0-9]{16}|AWS access key leaked
|
|
public|admin\.arikigame\.com|Internal admin URL in public content</code></pre>
|
|
<p>The scope field controls where patterns apply. <code>all</code> means every file. <code>public</code> means only public-facing content — blog posts, website, marketing pages. We <em>want</em> classified codenames in internal architecture docs. We just don't want them in blog posts.</p>
|
|
<p>The blocklist runs grep against the staged diff. No network call, no API, no latency. Match found → commit blocked immediately with file path and explanation. This catches 80% of issues before the LLM wakes up.</p>
|
|
<h2>Layer 2: DeepSeek V4 Flash review (~4s, $0.001)</h2>
|
|
<p>If the commit touches public-facing files, the hook sends the staged diff to DeepSeek V4 Flash. The system prompt tells it exactly what to check:</p>
|
|
<ul>
|
|
<li><strong>Leaked secrets</strong> — API keys, tokens, credentials the regex might have missed</li>
|
|
<li><strong>Classified terms</strong> — codenames not yet in the blocklist</li>
|
|
<li><strong>Internal URLs</strong> — references to services that shouldn't be public</li>
|
|
<li><strong>Blog quality</strong> — title length, meta description, slug consistency</li>
|
|
<li><strong>Broken links</strong> — malformed URLs, obvious typos</li>
|
|
<li><strong>Announcements</strong> — if it's a new blog post, draft a one-line summary</li>
|
|
</ul>
|
|
<p>The model responds with structured JSON: <code>errors</code> (block) or <code>warnings</code> (inform but allow). If the API is unreachable or times out, the commit proceeds — the hook never blocks work for infrastructure reasons.</p>
|
|
<h2>The architecture</h2>
|
|
<pre><code>git commit
|
|
↓
|
|
Phase 0: Collect staged diff + classify files (public vs internal)
|
|
↓
|
|
Phase 1: Regex blocklist scan (instant, free)
|
|
→ Match → BLOCK
|
|
→ Clean → continue
|
|
↓
|
|
Phase 2: Public files changed?
|
|
→ No → exit 0 (skip AI review, zero cost)
|
|
→ Yes → send diff to DeepSeek V4 Flash
|
|
↓
|
|
Phase 3: Parse JSON response
|
|
→ Errors → BLOCK
|
|
→ Warnings → print, exit 0
|
|
→ Announcement → print draft
|
|
→ API failure → warn, exit 0 (never block on infra)</code></pre>
|
|
<p>The hook lives in <code>.githooks/</code> — committed, version-controlled, shared by the team. A setup script points <code>git config core.hooksPath</code> there.</p>
|
|
<h2>What it costs</h2>
|
|
<p>| | Tokens | Cost |</p>
|
|
<p>|–|——–|——|</p>
|
|
<p>| Input (prompt + diff) | ~4,000 | $0.00056 |</p>
|
|
<p>| Output (JSON response) | ~200 | $0.00006 |</p>
|
|
<p>| <strong>Per commit</strong> | | <strong>$0.00062</strong> |</p>
|
|
<p>A tenth of a cent. Twenty commits a day: $0.012/day. About <strong>$0.40/month</strong>. Commits that only touch internal files skip the AI review entirely — zero cost.</p>
|
|
<h2>What it caught (first week)</h2>
|
|
<ul>
|
|
<li><strong>2 classified codename leaks</strong> in draft blog posts — caught by blocklist</li>
|
|
<li><strong>1 GitHub URL</strong> from an old copy-paste — caught by blocklist</li>
|
|
<li><strong>3 blog SEO warnings</strong> — titles over 60 chars, missing og_description — caught by AI</li>
|
|
<li><strong>1 announcement draft</strong> auto-generated when a new post was committed</li>
|
|
</ul>
|
|
<p>Zero false positives on the blocklist. Two false positives from the AI — flagged an internal URL in a code example that was clearly illustrative. We added a note to the prompt: ignore URLs inside fenced code blocks.</p>
|
|
<h2>Setup</h2>
|
|
<pre><code class="language-bash">bash scripts/setup-hooks.sh # or .\scripts\setup-hooks.ps1 on Windows
|
|
export TINQS_HOOK_TOKEN=<your-token> # same PAT used for git push</code></pre>
|
|
<p>That's it. Every <code>git commit</code> runs the two-layer review. Bypass with <code>git commit –no-verify</code> for emergencies.</p>
|
|
<h2>The pattern: guard rails at the edge</h2>
|
|
<p>This is the same principle we apply everywhere: put the guard rail where the action happens. Don't rely on a human checklist. Don't wait for code review. Don't hope someone remembers.</p>
|
|
<p>The pre-commit hook is $0.001 of prevention. A leaked API key in a public post is hours of rotation, revocation, and audit. A classified codename in a blog post is a confidentiality breach. A dead link is a broken experience nobody notices for weeks.</p>
|
|
<p>The tools exist. DeepSeek V4 Flash is cheap enough to call on every commit. The hook is 150 lines of bash. The blocklist is a text file. Total infrastructure cost: zero — it runs on the developer's machine, calls an API we already pay for, adds 4 seconds to the commit flow.</p>
|
|
<hr>
|
|
<p><em>The pre-commit hook is part of <a href="https://tinqs.com" style="color: var(–c-accent-l);">Tinqs Studio</a>. The inference proxy, blocklist patterns, and review prompt are open and reusable. Every commit in <a href="https://arikigame.com" style="color: var(–c-accent-l);">Ariki</a> runs through the same guard.</em></p>
|
|
|
|
</div>
|
|
|
|
<div class="post__author">
|
|
<div class="post__author-avatar">OB</div>
|
|
<div class="post__author-info">
|
|
<span class="post__author-name">Ozan Bozkurt</span><br>
|
|
CTO & Developer, Tinqs
|
|
</div>
|
|
</div>
|
|
</article>
|
|
|
|
<!-- FOOTER -->
|
|
<footer class="footer">
|
|
<div class="footer__inner">
|
|
<span class="footer__wordmark">TINQS</span>
|
|
<div class="footer__links">
|
|
<a href="/#game">Games</a>
|
|
<a href="/#tech">Technology</a>
|
|
<a href="/#about">About</a>
|
|
<a href="/blog/">Blog</a>
|
|
<a href="mailto:hello@tinqs.com">hello@tinqs.com</a>
|
|
<a href="/press">Press Kit</a>
|
|
</div>
|
|
<p class="footer__copy">Tinqs Limited — London, est. 2020</p>
|
|
</div>
|
|
</footer>
|
|
|
|
<script>
|
|
const burger = document.getElementById('navBurger');
|
|
const mobileMenu = document.getElementById('mobileMenu');
|
|
burger.addEventListener('click', () => {
|
|
const open = mobileMenu.classList.toggle('mobile-menu--open');
|
|
burger.classList.toggle('nav__burger--open', open);
|
|
document.body.style.overflow = open ? 'hidden' : '';
|
|
});
|
|
mobileMenu.querySelectorAll('a').forEach(link => {
|
|
link.addEventListener('click', () => {
|
|
mobileMenu.classList.remove('mobile-menu--open');
|
|
burger.classList.remove('nav__burger--open');
|
|
document.body.style.overflow = '';
|
|
});
|
|
});
|
|
</script>
|
|
|
|
</body>
|
|
</html>
|