Privacy and secrets

What is sent to an AI, what never is, and the secret scan.

What is sent to a remote AI:

  • A summary of your staged changes: file names, change counts, names of added or removed functions and classes, and the changed lines, up to about 12,000 characters. Large diffs are trimmed to fit.
  • Your settings: allowed types, the scope, the length limit and so on.

What is never sent:

  • Unstaged changes, and files you didn't stage.
  • The content of noise files. Lockfiles, build output, minified files, snapshots, binary files, and anything matching your ignore globs. They're listed by name only.
  • Anything flagged by the secret scan.

The secret scan

Before any remote call, gitmit scans everything it is about to send for:

  • Keys and tokens: AWS access and secret keys; GitHub, GitLab, npm and Slack tokens; Slack webhooks; Stripe, Google, SendGrid, OpenAI and Anthropic keys; JWTs.
  • Private keys: PEM blocks.
  • Embedded credentials: usernames and passwords in URLs, such as postgres://user:pass@host, and hardcoded password, secret, api_key or token values.
  • Sensitive files: .env and .env.* (except .env.example and similar templates), *.pem, *.key, SSH private keys, .npmrc, .netrc, credentials.json and service-account files.

Obvious placeholders such as changeme, <your-key> or ${API_KEY} are ignored.

When something is found:

  • By default, gitmit stops and sends nothing. It shows the file and a masked preview, such as ghp_…aa, so you can unstage it.
  • With --redact (or "secrets": { "onDetect": "redact" }), it replaces each secret with a marker like [REDACTED GitHub token] and withholds sensitive files' content entirely. Before sending, it scans again to confirm nothing remains.
  • In interactive mode, gitmit asks whether to send a redacted version.

Local providers (rules, and Ollama on your own machine) aren't scanned, because nothing leaves your computer.

The diff is always presented to the model as data, with explicit instructions not to follow anything written inside it. That protects against "prompt injection" hidden in code comments.