omerta

Not yet independently verified. omerta is a new open-source project from a single developer account, first released on 25 October 2026 and with 11 GitHub stars when we read it; we have not seen an independent review or test of what it catches. Details come from its README and GitHub releases, read on 27 October 2026. We will update this when it can be confirmed, and remove this note.

omerta is a free, open-source command-line tool and git pre-commit hook that stops secrets from a project's environment files reaching a git repository. It was published by the GitHub account shcherbak-ai, with version 0.1.0 released on 25 October 2026 and versions 0.1.1 and 0.1.2 on 27 October. It is written in Python, installs from PyPI and is released under the MIT licence.

What it does

Most secret scanners look for strings that resemble a key from a known provider. omerta works the other way round: it reads the actual values held in the developer's own .env and .env.* files that git does not track, and searches the repository for those exact values. That lets it catch secrets of any shape, such as a small provider's key, a storage bucket name or an organisation ID, which pattern rules can miss.

Each value is searched as written and in percent-encoded, JSON-escaped and base64 forms, in text files, binary files and file names. A tracked env file is reported as a leak in its own right. The check command searches the staged changes, a path or every tracked file, and the history command searches every file version and commit or tag message reachable from a branch, tag or HEAD, reporting the commit where a value first entered a file. Values are never printed: findings name the variable instead. It runs offline, skips values shorter than eight characters by default and skips template files such as .env.example.

How teams use it

It can run as a pre-commit hook through the pre-commit framework, Husky, Lefthook or a plain git hook, and in CI, where there is no .env file and it checks for env files that were committed. Settings live in .omerta.toml or in pyproject.toml, with options to choose the env files, ignore variables that are not secrets, change the minimum length and output JSON Lines. Exit codes are 0 for clean, 1 for a finding and 2 for an error, so it can gate a commit or a build.

Key facts

Maker: shcherbak-ai (GitHub) Released: 25 October 2026 (v0.1.0); v0.1.2 on 27 October 2026 Pricing: free and open source, MIT licence Requirements: Python 3.11 or later for the hook; runs through uv or pip Works with: pre-commit, Husky, Lefthook, plain git hooks, CI pipelines