git-secrets Environment Risk Statusline

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL

https://heyclau.de/entry/statuslines/git-secrets-env-risk-statusline

Source URLs

https://github.com/awslabs/git-secrets

Safety notes

The default mode does not scan file contents; it only counts sensitive-looking environment files in Git status., Enable recursive git-secrets scanning only in repositories where you are authorized to inspect all files., Scanner mode invokes the git-secrets executable directly and does not fall back to Git aliases., Treat any scan warning as a stop-and-review signal before committing, sharing logs, or opening a PR.

Privacy notes

The default output prints counts only and does not print filenames or matched values., Recursive scans read repository files and may inspect sensitive local material., Terminal recordings can still reveal that a workspace contains sensitive environment files.

Author

MkDev11

Submitted by

MkDev11

Claim status

unclaimed

Last verified

2026-06-04

• The default output prints counts only and does not print filenames or matched values.
• Recursive scans read repository files and may inspect sensitive local material.
• Terminal recordings can still reveal that a workspace contains sensitive environment files.

• Git installed and the command run from a repository worktree.
• Optional git-secrets installed if GIT_SECRETS_STATUSLINE_SCAN is set to 1.
• A slower refresh interval when optional scanning is enabled, because recursive scans can be expensive.

Show that git-secrets Environment Risk Statusline is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

[![Listed on HeyClaude](https://heyclau.de/badge/statuslines/git-secrets-env-risk-statusline.svg)](https://heyclau.de/entry/statuslines/git-secrets-env-risk-statusline)

git-secrets Environment Risk Statusline side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field	git-secrets Environment Risk Statusline Claude Code statusline that surfaces sensitive environment-file risk and can optionally run git-secrets as a local pre-commit-style scanner. Open dossier	kubectl Deployment Context Statusline Claude Code statusline that shows the active kubectl context and namespace with a deployment-environment risk label. Open dossier	OSV Dependency Risk Statusline Claude Code statusline that reads OSV-Scanner JSON results and prints a compact dependency vulnerability count for review sessions. Open dossier	MCP Auth Surface Statusline Claude Code statusline that summarizes MCP server count, remote endpoint count, and credential-surface hints without printing tokens, secrets, local paths, or full endpoint URLs. Open dossier
Next stepsDiffers	Open dossierCopy configAPI JSONOpen LLMOpen sourceNewsletterClaim listing	Open dossierCopy configAPI JSONOpen LLMOpen sourceNewsletterClaim listing	Open dossierCopy configAPI JSONOpen LLMOpen sourceNewsletterClaim listing	Open dossierCopy installCopy configAPI JSONOpen LLMOpen sourceNewsletterClaim listing
Trust	Review first	Review first	Review first	Review first
Review status	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed
Package trust	Package not verified	Package not verified	Package not verified	Package not verified
Source provenance	Source-backed	Source-backed	Source-backed	Source-backed
SubmitterDiffers	MkDev11	MkDev11	MkDev11	JSONbored
Install risk	Review first	Review first	Review first	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	—	Kubernetes	—	—
Category	statuslines	statuslines	statuslines	statuslines
Source	Source-backed	Source-backed	Source-backed	Source-backed
Author	MkDev11	MkDev11	MkDev11	JSONbored
Added	2026-06-04	2026-06-04	2026-06-04	2026-06-05
Platforms	Claude Code	Claude Code	Claude Code	Claude Code
Harness	Claude Code	Claude Code	Claude Code	Claude Code
Source repo	—	—	—	—
Safety notes	✓The default mode does not scan file contents; it only counts sensitive-looking environment files in Git status. Enable recursive git-secrets scanning only in repositories where you are authorized to inspect all files. Scanner mode invokes the git-secrets executable directly and does not fall back to Git aliases. Treat any scan warning as a stop-and-review signal before committing, sharing logs, or opening a PR.	✓The script is read-only and does not contact workloads, apply manifests, or change namespaces. The displayed context and namespace are limited to printable ASCII before terminal output. Risk labels are based on names; confirm the actual cluster and namespace before deployment commands. Avoid running write-capable automation solely because the statusline says an environment looks like development.	✓Prefer reading a precomputed report; scanning dependencies during every statusline refresh can be slow. Auto-scan mode refuses symlinked report paths and writes through a temporary file before replacing the report. Vulnerability counts need human triage for reachability, exploitability, and acceptable remediation timing. Do not let a zero count replace lockfile review, provenance checks, or package-manager audit policy.	✓This statusline is advisory and should not be used as the only MCP authorization review. It intentionally avoids printing full URLs, local paths, header names, tokens, or environment variable values. Remote endpoints and credential hints should trigger a separate review of protected resource metadata, scopes, and token handling.
Privacy notes	✓The default output prints counts only and does not print filenames or matched values. Recursive scans read repository files and may inspect sensitive local material. Terminal recordings can still reveal that a workspace contains sensitive environment files.	✓Context and namespace names can expose customer, region, cluster, or service names in screenshots. kubectl reads local kubeconfig, which may reference private clusters and identities. The script does not print server URLs or certificates.	✓OSV reports can reveal package names, versions, ecosystems, and repository structure. The statusline prints only the count, but the local JSON report may contain detailed dependency metadata. If scans run against private package manifests, review where the scanner sends package coordinates.	✓The statusline reads Claude Code session metadata from stdin and prints only counts plus a generic credential hint. Avoid modifying the script to print full server URLs, headers, tokens, local config paths, or account identifiers on shared screens.
Prerequisites	Git installed and the command run from a repository worktree. Optional git-secrets installed if GIT_SECRETS_STATUSLINE_SCAN is set to 1. A slower refresh interval when optional scanning is enabled, because recursive scans can be expensive.	kubectl installed and configured for the environments you want visible. A kubeconfig context selected before Claude Code starts or before the statusline refreshes. Team naming conventions that distinguish production, staging, and development contexts.	OSV-Scanner JSON report at `osv-report.json`, or OSV_STATUSLINE_JSON set to another report path. jq available for reading the report. Optional OSV-Scanner CLI installed if OSV_STATUSLINE_SCAN is set to 1.	Claude Code CLI with statusline support. jq installed locally. MCP server metadata available in the Claude Code statusline input.
Install	—	—	—	mkdir -p .claude/statuslines tmp="$(mktemp .claude/statuslines/mcp-auth-surface.sh.XXXXXX)" cat > "$tmp" <<'EOF' #!/usr/bin/env bash set -u input=$(cat) if ! command -v jq >/dev/null 2>&1; then printf 'MCP auth: jq unavailable\n' exit 0 fi servers=$(printf '%s' "$input" | jq -c '.mcp.servers // []' 2>/dev/null || printf '[]') server_count=$(printf '%s' "$servers" | jq 'length' 2>/dev/null || printf '0') remote_count=$(printf '%s' "$servers" | jq '[.[] | select((.url // .endpoint // "") | test("^https?://"))] | length' 2>/dev/null || printf '0') credential_hint=$(printf '%s' "$servers" | jq '[.[] | select((.auth // .authorization // .headers // .env // null) != null)] | length' 2>/dev/null || printf '0') if [ "$credential_hint" -gt 0 ]; then state="credentials: review" else state="credentials: none shown" fi printf 'MCP auth: %s servers | %s remote | %s\n' "$server_count" "$remote_count" "$state" EOF chmod 700 "$tmp" mv -f "$tmp" .claude/statuslines/mcp-auth-surface.sh Copy install
Config	{ "statusLine": { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/statuslines/git-secrets-env-risk-statusline.sh" } } Copy config	{ "statusLine": { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/statuslines/kubectl-deployment-context-statusline.sh" } } Copy config	{ "statusLine": { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/statuslines/osv-dependency-risk-statusline.sh" } } Copy config	{ "statusLine": { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/statuslines/mcp-auth-surface.sh" } } Copy config
Citations	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationgithub.com Submitted by MkDev112026-06-04 Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationkubernetes.io Submitted by MkDev112026-06-04 Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationgoogle.github.io Submitted by MkDev112026-06-04 Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationcode.claude.com Submitted by JSONbored2026-06-05 Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed	Unclaimed

Source-backed guides for putting this to work.