A water-utility repository nearly had a coding agent commit a hardcoded credential. The platform team wants to automatically stop this specific class of mistake before it reaches the repository, without slowing down every other type of commit. What should they configure?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a metal detector at the door instead of a security guard reviewing yesterday's security footage: you want the credential caught on the way in, not discovered after it's already inside. A hook wired to commit time is that detector — it checks staged changes against credential patterns and blocks the commit before it ever lands in the repository. Scanning history afterward, or just writing a policy document, both let the secret through first.
Full Explanation
Antigravity supports hooks that run at defined points in the agent's workflow, and a pre-commit hook is the mechanism designed to intercept a specific class of unsafe action — like a hardcoded credential — before it becomes part of the repository's history, rather than flagging it afterward.
A subagent that scans commit history after the fact is detection, not prevention: by the time it runs, the credential has already been pushed and may need rotation regardless of whether it's caught. A custom skill documenting policy gives the agent guidance to follow but nothing that mechanically stops a mistake when the agent doesn't follow it. Removing write access entirely overcorrects, disabling the agent's core capability to solve one narrow risk instead of targeting that risk specifically.
Scope note: a credential-pattern hook catches recognizable secret formats, not every possible sensitive value, so it complements rather than replaces broader secret-scanning practices. Operational check: intentionally stage a dummy credential-shaped string in a test branch and confirm the hook actually blocks the commit before relying on it in production.