{"record":{"id":"3337ff938382116c","repo":"nikivdev/code","slug":"refusing-to-commit-sensitive-files-set-flow-allow","errorCode":null,"errorMessage":"Refusing to commit sensitive files. Set FLOW_ALLOW_SENSITIVE_COMMIT=1 to override.","messagePattern":"Refusing to commit sensitive files\\. Set FLOW_ALLOW_SENSITIVE_COMMIT=1 to override\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/commit.rs","lineNumber":318,"sourceCode":"    if files.is_empty() {\n        return Ok(());\n    }\n\n    if env::var(\"FLOW_ALLOW_SENSITIVE_COMMIT\").ok().as_deref() == Some(\"1\") {\n        return Ok(());\n    }\n\n    println!(\"\\n⚠️  Warning: Potentially sensitive files detected:\");\n    for file in files {\n        println!(\"   - {}\", file);\n    }\n    println!();\n    println!(\"These files may contain secrets. Consider:\");\n    println!(\"   - Adding them to .gitignore\");\n    println!(\"   - Using `git reset HEAD <file>` to unstage\");\n    println!();\n\n    bail!(\"Refusing to commit sensitive files. Set FLOW_ALLOW_SENSITIVE_COMMIT=1 to override.\")\n}\n\n/// Warn about secrets found in diff and optionally abort.\nfn warn_secrets_in_diff(\n    repo_root: &Path,\n    findings: &[(String, usize, String, String)],\n) -> Result<()> {\n    if findings.is_empty() {\n        return Ok(());\n    }\n\n    if env::var(\"FLOW_ALLOW_SECRET_COMMIT\").ok().as_deref() == Some(\"1\") {\n        println!(\n            \"\\n⚠️  Warning: Potential secrets detected but FLOW_ALLOW_SECRET_COMMIT=1, continuing...\"\n        );\n        return Ok(());\n    }\n","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/commit.rs#L300-L336","documentation":"This error is raised by `warn_sensitive_files` in src/commit.rs when the staged changeset contains files whose names/paths look sensitive (e.g. keys, credentials, .env). The library deliberately aborts the commit flow to prevent secret leakage and tells the user how to override with FLOW_ALLOW_SENSITIVE_COMMIT=1. It is an intentional guardrail, not an unexpected failure.","triggerScenarios":"Running the commit flow (`run_sync`, `run_fast`, or `run_with_check_sync`) with files like `.env`, `*.pem`, `id_rsa`, `credentials.json` etc. staged for commit; `warn_sensitive_files` prints guidance and bails.","commonSituations":"Staging a local `.env` alongside source changes with `git add .`, committing a service-account key downloaded for testing, or copying certificates into the repo directory and accidentally including them.","solutions":["Unstage the file: `git reset HEAD <file>` and add it to .gitignore.","Move the secret out of the repo and reference it via environment variables or a secrets manager.","If the file is genuinely non-sensitive (e.g. a fixture), re-run with `FLOW_ALLOW_SENSITIVE_COMMIT=1` after verifying its contents.","Rename/relocate the file so it no longer matches the sensitive-path heuristics if it is a false positive."],"exampleFix":"// before: .env staged\ngit add .\n// after\ngit reset HEAD .env\necho \".env\" >> .gitignore","handlingStrategy":"validation","validationCode":"// before invoking the commit flow, scan staged files yourself\nlet sensitive = [\".env\", \".pem\", \".key\", \"id_rsa\", \"credentials\"];\nlet staged: Vec<String> = staged_files()?; // `git diff --cached --name-only`\nif let Some(f) = staged.iter().find(|f| sensitive.iter().any(|s| f.contains(s))) {\n    eprintln!(\"unstage {f} first: git reset HEAD {f}\");\n    std::process::exit(1);\n}","typeGuard":"fn is_sensitive_path(path: &str) -> bool {\n    [\".env\", \".pem\", \".key\", \"id_rsa\", \"credentials\"]\n        .iter().any(|s| path.contains(s))\n}","tryCatchPattern":"match run_fast() {\n    Err(e) if e.to_string().contains(\"FLOW_ALLOW_SENSITIVE_COMMIT\") => {\n        eprintln!(\"unstage sensitive files or re-run with FLOW_ALLOW_SENSITIVE_COMMIT=1\");\n    }\n    Err(e) => return Err(e),\n    Ok(_) => {}\n}","preventionTips":["Keep .env, keys and certificates in .gitignore from day one","Use `git status` before `git add .` — prefer explicit file adds","Store secrets in a secrets manager or env vars, never in the repo tree","Only set FLOW_ALLOW_SENSITIVE_COMMIT=1 after manually verifying file contents"],"tags":["git","security","secrets","commit-guard"],"backgroundTag":"sensitive-file-commit-blocked","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}