The commit freezes in your terminal. A hook runs before your code leaves your machine. It checks for secrets, misconfigurations, and forbidden patterns. This is the power of pre-commit security hooks, and it changes how teams ship code.
Pre-commit security hooks catch problems at the earliest possible point in the lifecycle. They run automatically before a commit is recorded in your local Git history. Configured well, they block insecure changes from ever reaching the repository. This prevents sensitive data leaks, hard-coded credentials, and violations of security policy.
Sub-processors take these hooks further. Instead of a single monolithic check, sub-processors split security tasks into smaller, isolated modules. Each sub-processor can run a specific scanning tool, linting task, or validation script. The main hook orchestrates them in sequence or in parallel. This architecture keeps checks fast, modular, and easy to maintain.
Using sub-processors for pre-commit security allows security rules to evolve without disrupting the core workflow. You can add, remove, or update a scanning sub-processor without rewriting the entire hook. Teams often use sub-processors to separate language-specific checks, compliance scans, or dependency vulnerability audits.