How pre-commit scans work

A pre-commit scan reviews the changes you're about to commit and reports security problems. It runs from a Git hook, so it happens on every commit without you doing anything.

$ git commit -m "add invoice export"
Running Lighthouse scan
! 2 finding(s)
  critical 0  high 1  medium 0  low 1
  report  .git/lighthouse/findings/3f2a….md
  view    https://lighthouse.rewarelabs.com/scans/3f2a…
[main 4c1d2e7] add invoice export

What happens on commitCopy Anchor Link

1. Git runs the pre-commit hook that reware-lighthouse init installed.
2. The hook runs reware-lighthouse scan, which sends your staged changes (what git diff --cached shows) to Lighthouse with your branch and commit.
3. Lighthouse reviews the change.
4. The CLI prints a summary, saves the full report, and links to it in the dashboard.
5. If a finding reaches your repository's blocking policy, the commit stops. Otherwise it goes through.

Only staged changes are scanned. Unstaged edits and untracked files aren't sent.

Scan without committingCopy Anchor Link

git add -p
reware-lighthouse scan

DepthCopy Anchor Link

Pre-commit scans use Normal depth by default, which reviews the change itself and keeps commits fast. Max also uses what ingestion learned about the repository, and takes longer. See Scan depth.

What's sentCopy Anchor Link

Your staged diff (including deleted files), your branch name, your HEAD commit, the newest commit already on the remote, and how many commits you haven't pushed. Lighthouse uses these to review the change against the matching code. The code is deleted from Lighthouse when the scan ends. Only the findings are kept.

RelatedCopy Anchor Link

• Read a scan report
• When your commit is blocked
• When Lighthouse can't scan