Refusing to commit potential secrets. Review the findings ab

Error message

Refusing to commit potential secrets. Review the findings above.

What it means

This is the terminal error of `warn_secrets_in_diff`: after manual/auto fix attempts (or when no fix path applies), potential secrets remain in the diff, so the library refuses to create the commit and asks the user to review the printed findings. The findings (file, line, kind, snippet) are printed just before this bail so the user knows exactly what to fix.

Source

Thrown at src/commit.rs:446

    }

    if current_findings != findings {
        print_secret_findings(
            "🔐 Potential secrets still detected in staged changes:",
            &current_findings,
        );
        println!();
    }

    let task = build_fix_f_commit_task(&current_findings);
    if !task.trim().is_empty() {
        eprintln!("Suggested prompt (copy/paste into your model):");
        eprintln!("────────────────────────────────────────");
        eprintln!("{}", task);
        eprintln!("────────────────────────────────────────");
    }

    bail!("Refusing to commit potential secrets. Review the findings above.")
}

fn should_run_sync_for_secret_fixes(repo_root: &Path) -> Result<bool> {
    if !io::stdin().is_terminal() {
        return Ok(false);
    }
    if env::var("FLOW_ALLOW_SECRET_COMMIT").ok().as_deref() == Some("1") {
        return Ok(false);
    }

    let agent_name =
        env::var("FLOW_FIX_COMMIT_AGENT").unwrap_or_else(|_| "fix-f-commit".to_string());
    let handoff_enabled = agent_name.trim().to_lowercase() != "off";
    let ai_available = which::which("ai").is_ok();
    if !handoff_enabled && !ai_available {
        return Ok(false);
    }

View on GitHub (pinned to a747e741ae)

Solutions

Review the printed findings, remove or redact the secrets from the files, then re-run the commit flow.
Rotate any real credentials that were staged — assume they are compromised if they were ever written to disk in the repo.
Move secrets to environment variables or a secrets manager and re-commit sanitized files.
Add intentionally-fake/example values to the scanner's allowlist if they are false positives.

Example fix

// before
let api_key = "sk-live-4eC39HqLyjWDarjtT1zdp7dc";
// after
let api_key = std::env::var("STRIPE_API_KEY").context("STRIPE_API_KEY not set")?;

Defensive patterns

Strategy: validation

Validate before calling

// scan your own diff before committing
let findings = scan_diff_for_secrets(repo_root); // or `gitleaks detect --no-git` equivalent
if !findings.is_empty() {
    for (file, line, kind, _) in &findings {
        eprintln!("secret {kind} at {file}:{line}");
    }
    std::process::exit(1);
}

Type guard

fn diff_has_secrets(repo_root: &std::path::Path) -> bool {
    !scan_diff_for_secrets(repo_root).is_empty()
}

Try / catch

match run_with_check_sync() {
    Err(e) if e.to_string().contains("Refusing to commit potential secrets") => {
        eprintln!("redact the flagged lines, rotate exposed credentials, then retry");
    }
    Err(e) => return Err(e),
    Ok(_) => {}
}

Prevention

Never hardcode keys — load them from env vars or a secrets manager
Run a secret scanner (gitleaks/trufflehog) as a pre-commit hook
Rotate any credential that has ever been staged or committed
Add allowlist entries for intentional placeholder values to reduce noise

When it happens

Trigger: `run_sync`/`run_fast`/`run_with_check_sync` detect secret findings via diff scanning; either no fix path ran (non-interactive stdin, FLOW_FIX_COMMIT_AGENT=off, declined prompts) or fixes did not clear the findings, leading to the final bail.

Common situations: Real API keys, passwords, or tokens pasted into source/config files; running the commit from a non-TTY (CI) where the interactive fix prompts are skipped; fix attempts incomplete so the re-scan still finds matches.

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/2e6a5351636b7ee4. Report an issue: GitHub.