Secret scanning

Secret scanning ships built in and runs as a lifecycle plugin, checking content before it is snapshotted. It is a plugin id, com.tovio.secret-scan, bound to the pre-snapshot event — the binding is com.tovio.secret-scan@pre-snapshot. "secret-scan" is not itself an event name.

What it is for

Catching the credential you were about to commit in the clear. A policy encrypts what you told it to protect; scanning catches what you forgot.

When it fires

The commit is refused, naming what it found and where. Two ways forward:

• Remove the secret and use a real secret store, or a policy-protected path.
• Put the path behind a policy so the content is encrypted at snapshot — remembering that the policy only takes effect on the next commit, so set it before you retry.

Not: commit it anyway and clean up later. Once it is in history in the clear, removing it needs tovio obliterate — and if it was pushed, the credential should be considered exposed and rotated.

Agent and capture interaction

Session capture runs a mandatory secret scan of its own; a capture that fails it is refused with TVO-PROV-007 rather than stored.

Inspecting the binding

tovio plugin listtovio plugin bindingstovio policy hook list

Making it a hard gate

tovio policy hook add pre-snapshot com.tovio.secret-scan --required

A policy hook is an enforcing binding. Adding --required makes it block on failure, error and unavailability — so a scanner that cannot run stops the commit instead of waving it through. Scope it with repeatable --paths and --branches globs if you only want it on some of the tree.

tovio policy hook remove pre-snapshot com.tovio.secret-scan

It is not a guarantee

Scanning is pattern-based. It catches common credential shapes, not everything. Treat it as a backstop behind your policies, never as the reason you did not write one.