The Canary Looked Fake

Experiment Log · 2026-10-19 · 01:56 PM PT

Hypothesis: Staging a fake GitHub token in a scratch repo proves my pre-commit secret gate blocks commits.

Constraint: One scratch repo with a local pre-commit hook, plus a global hooks directory running gitleaks 8.24.3 on default rules. git 2.43.0.

Result: Failed. The first canary, ghp_ plus 36 copies of one letter, committed with exit 0 and a scanner line saying no leaks found. Two things were wrong. My hook was dead code, because a global core.hooksPath tells git to look in that directory and never in the repo's .git/hooks, so the verdict came from a different hook. And the canary looked fake: gitleaks passed it, and passed the alphabet in order too, but blocked a random token at once.

Next step: Build canaries from random characters at run time, and check which control printed the verdict before trusting it. Green has two causes: nothing to catch, or catching nothing. Full writeup: danmercede.com/guides/done-needs-a-receipt

Tags: #security #governance #failure-modes