initial commit

hooks/pre-commit

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Pre-commit hook for the secrets repo.
+# Rejects staged files matching .env patterns without .age extension.
+# This is a safety net, not a security boundary (--no-verify bypasses it).
+
+BLOCKED=$(git diff --cached --name-only | grep -E '\.env' | grep -v '\.age$' || true)
+if [ -n "$BLOCKED" ]; then
+  echo "ERROR: Plaintext env files staged for commit:"
+  echo "$BLOCKED"
+  echo "Only .age (encrypted) files should be committed."
+  exit 1
+fi