#!/bin/bash
while read local_ref local_sha remote_ref remote_sha; do
    if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
        range="$local_sha"
    else
        range="$remote_sha..$local_sha"
    fi
    
    LEAKS=$(git diff "$range" | grep -E -i 'api_key\s*=|password\s*=|ghp_' || true)
    if [ -n "$LEAKS" ]; then
        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
        echo "SECURITY ALERT: Potential secret found in outgoing commits!"
        echo "$LEAKS"
        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
        exit 1
    fi
done
exit 0