Security

Security

gitai is designed with security in mind.

Local Keyword Scanner

Before sending any git diff to an AI provider, gitai scans the content locally for sensitive patterns. This prevents accidental leakage of API keys, passwords, or private tokens to third-party LLMs.

How it works

1. Gitai fetches the diff.
2. It compares the added lines against a list of blocked keywords.
3. If a match is found, the process aborts immediately with a warning, showing exactly what matched.
4. No network request is made.

Default Blocklist

The built-in blocklist includes common sensitive terms:

• api_key, apikey, secret, token
• password, passwd, pwd
• private_key, auth_token, access_token
• client_secret
• ...and more.

Configuring the Blocklist

You can extend this list in your config file or via environment variables.

Via Config (gitai.yaml):

security:
  keywords:
    - "stripe_live_key"
    - "internal_auth_header"

Via Environment Variable:

export GITAI_SENSITIVE_KEYWORDS="stripe_live_key,internal_auth_header"

Privacy & AI Providers

• Ollama (Recommended for Privacy): If you run gitai with the ollama provider, everything happens on your local machine. Your code never leaves your computer.
• Third-Party APIs (GPT, Gemini): When using these providers, the diff of your staged changes is sent to their servers.
  • Do not include secrets in your commits (the scanner helps, but isn't foolproof).
  • Be aware of the data retention policies of the AI provider you choose.