safe-push

Scan staged git changes for sensitive information before committing. Checks for API keys, credentials, infrastructure details, PII, and sensitive config files. Behavior adapts to repo visibility: blocks on public repos, warns on private repos. Supports project-level allowlist via .claude/allowlist.json. Use when: committing code, before commit, check sensitive info, pre-commit check, 扫描泄露, 检查敏感信息, commit 前检查.