Comment by mksybr

You can put something like detect-secrets[1] in a commit hook.

  no_secrets=$(git diff --staged --name-only -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline)
  test -z $no_secrets && exit $no_secrets

1: https://github.com/Yelp/detect-secrets