Refusing to commit sensitive files. Set FLOW_ALLOW_SENSITIVE

Error message

Refusing to commit sensitive files. Set FLOW_ALLOW_SENSITIVE_COMMIT=1 to override.

What it means

This error is raised by `warn_sensitive_files` in src/commit.rs when the staged changeset contains files whose names/paths look sensitive (e.g. keys, credentials, .env). The library deliberately aborts the commit flow to prevent secret leakage and tells the user how to override with FLOW_ALLOW_SENSITIVE_COMMIT=1. It is an intentional guardrail, not an unexpected failure.

Source

Thrown at src/commit.rs:318

    if files.is_empty() {
        return Ok(());
    }

    if env::var("FLOW_ALLOW_SENSITIVE_COMMIT").ok().as_deref() == Some("1") {
        return Ok(());
    }

    println!("\n⚠️  Warning: Potentially sensitive files detected:");
    for file in files {
        println!("   - {}", file);
    }
    println!();
    println!("These files may contain secrets. Consider:");
    println!("   - Adding them to .gitignore");
    println!("   - Using `git reset HEAD <file>` to unstage");
    println!();

    bail!("Refusing to commit sensitive files. Set FLOW_ALLOW_SENSITIVE_COMMIT=1 to override.")
}

/// Warn about secrets found in diff and optionally abort.
fn warn_secrets_in_diff(
    repo_root: &Path,
    findings: &[(String, usize, String, String)],
) -> Result<()> {
    if findings.is_empty() {
        return Ok(());
    }

    if env::var("FLOW_ALLOW_SECRET_COMMIT").ok().as_deref() == Some("1") {
        println!(
            "\n⚠️  Warning: Potential secrets detected but FLOW_ALLOW_SECRET_COMMIT=1, continuing..."
        );
        return Ok(());
    }

View on GitHub (pinned to a747e741ae)

Solutions

Unstage the file: `git reset HEAD <file>` and add it to .gitignore.
Move the secret out of the repo and reference it via environment variables or a secrets manager.
If the file is genuinely non-sensitive (e.g. a fixture), re-run with `FLOW_ALLOW_SENSITIVE_COMMIT=1` after verifying its contents.
Rename/relocate the file so it no longer matches the sensitive-path heuristics if it is a false positive.

Example fix

// before: .env staged
git add .
// after
git reset HEAD .env
echo ".env" >> .gitignore

Defensive patterns

Strategy: validation

Validate before calling

// before invoking the commit flow, scan staged files yourself
let sensitive = [".env", ".pem", ".key", "id_rsa", "credentials"];
let staged: Vec<String> = staged_files()?; // `git diff --cached --name-only`
if let Some(f) = staged.iter().find(|f| sensitive.iter().any(|s| f.contains(s))) {
    eprintln!("unstage {f} first: git reset HEAD {f}");
    std::process::exit(1);
}

Type guard

fn is_sensitive_path(path: &str) -> bool {
    [".env", ".pem", ".key", "id_rsa", "credentials"]
        .iter().any(|s| path.contains(s))
}

Try / catch

match run_fast() {
    Err(e) if e.to_string().contains("FLOW_ALLOW_SENSITIVE_COMMIT") => {
        eprintln!("unstage sensitive files or re-run with FLOW_ALLOW_SENSITIVE_COMMIT=1");
    }
    Err(e) => return Err(e),
    Ok(_) => {}
}

Prevention

Keep .env, keys and certificates in .gitignore from day one
Use `git status` before `git add .` — prefer explicit file adds
Store secrets in a secrets manager or env vars, never in the repo tree
Only set FLOW_ALLOW_SENSITIVE_COMMIT=1 after manually verifying file contents

When it happens

Trigger: Running the commit flow (`run_sync`, `run_fast`, or `run_with_check_sync`) with files like `.env`, `*.pem`, `id_rsa`, `credentials.json` etc. staged for commit; `warn_sensitive_files` prints guidance and bails.

Common situations: Staging a local `.env` alongside source changes with `git add .`, committing a service-account key downloaded for testing, or copying certificates into the repo directory and accidentally including them.

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/3337ff938382116c. Report an issue: GitHub.