Prepush-Guardian: Catch Secrets and Broken Tests Before They Reach Git History

You are about to push. There is a hardcoded API key buried in one of 30 changed files. Or you forgot to write a test for that new module. Or the test suite is silently failing. You will not know until it is already in git history.

Prepush-Guardian catches all of this before the push lands. It is a production-grade Git pre-push hook that scans staged files for secrets, auto-generates missing tests, runs your full test suite, and blocks the push if anything fails before it ever reaches the remote.

Detection Patterns

The secret scanner covers 20+ patterns across four severity levels:

Configuration

Create .neo/config.json to customize behavior. It is auto-created with defaults if absent:

coverage_warn_threshold - default 70. Warn if coverage drops below this percentage.

coverage_block_threshold - default 50. Block push if coverage drops below this percentage.

block_on_low_severity - default false. Also hard-block on LOW findings.

auto_fix_gitignore - default true. Add sensitive filenames to .gitignore automatically.

generate_missing_tests - default true. Auto-generate tests for untested source files.

skip_test_check_for - default ["migrations/", "scripts/", "docs/"]. Directories excluded from test generation.

Exit Codes

0 : All checks passed - push proceeding

1 : Push blocked - CRITICAL/HIGH findings or test failures

File Structure

prepush-guardian/

├── prepush_guardian.py      # Main orchestrator

├── leak_detector.py         # Phase 1: secret & entropy detection

├── test_generator.py        # Phase 2: AI test generation

├── test_runner.py           # Phase 2: test execution + coverage

├── reporter.py              # Phase 3: markdown report

├── install.py               # Hook installer

├── requirements.txt

├── .env.example

├── .gitignore

├── LICENSE

├── CONTRIBUTING.md

├── architecture.excalidraw

├── infographic.svg

└── tests/

    ├── test_leak_detector.py

    └── fixtures/

        ├── sample_with_secrets.py

        └── sample_clean.py

The three-phase structure maps cleanly to the file names - leak_detector.py handles Phase 1, test_generator.py and test_runner.py handle Phase 2, and reporter.py handles Phase 3. prepush_guardian.py orchestrates all three phases in sequence.

How I Built This Using NEO

This project was built using NEO.

You can also build with NEO in your IDE using the .

You can use NEO MCP with Claude Code: https://heyneo.com/claude-code