Pre-commit Hooks vs. Pipeline Security Scans

July 1, 2025

blog art

When I first started diving deeper into DevOps practices, I found myself a bit confused about the difference between pre-commit hooks for security scanning and running tools like Snyk or other security scans in CI/CD pipelines. At first glance, they seemed to accomplish the same thing... scanning code for security issues. So why would you need both? Wasn't this just duplicated effort?

After some research and hands-on experience + testing, I realized these two approaches serve very different purposes in terms of your security strategy. Let me share what I learned to help clear up this confusion for others who might be wondering the same thing.

Understanding Pre-commit Hooks

Pre-commit hooks are security checks that run before your code ever leaves your local machine. Think of them as your personal security guard that stops you at the door if you're about to make a mistake.

When Pre-commit Hooks Run:

  • Before code is committed to version control
  • On your local developer machine catches issues immediately
  • Mandatory enforcement prevents commits if security issues are found
  • Real-time feedback during your development workflow

What They're Great At Catching:

  • Secrets and credentials accidentally added to code
  • Basic security patterns like hardcoded passwords or API keys
  • Code quality issues that could lead to vulnerabilities
  • Simple dependency issues in manifest files

Here's what a typical pre-commit security setup looks like:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0  
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
  
  - repo: https://github.com/PyCQA/bandit
    rev: '1.7.5'
    hooks:
      - id: bandit
  
  - repo: https://github.com/gitguardian/ggshield
    rev: v1.40.0 
    hooks:
      - id: ggshield
        language_version: python3
        stages: [pre-commit]

Understanding Pipeline Security Scans

Pipeline scans, on the other hand, are security assessments that happen after your code is pushed to the repository, typically as part of your CI/CD process.

When Pipeline Scans Run:

  • After code is pushed to the repository
  • In your CI/CD pipeline during the build/deploy process
  • Configurable enforcement can block deployments or just provide warnings
  • Batch processing of your entire codebase

What They Excel At:

  • Deep dependency analysis using vulnerability databases
  • Container image scanning for OS packages and base image vulnerabilities
  • Infrastructure as Code scanning (Terraform, etc.)
  • License compliance analysis
  • Advanced static analysis of your complete application

Here's an example of a pipeline security scan:

# GitHub Actions workflow
name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --fail-on=upgradable

The Key Differences That Matter

Once I understood the timing and scope differences, everything clicked into place:

Timing
Pre-commit Hooks: Before commit (local)
Pipeline Scans: After push (remote)

Speed
Pre-commit Hooks: Fast, lightweight
Pipeline Scans: Slower, comprehensive

Scope
Pre-commit Hooks: Limited, focused checks
Pipeline Scans: Full codebase plus dependencies

Enforcement
Pre-commit Hooks: Blocks commits immediately
Pipeline Scans: Can block deployment

Developer Experience
Pre-commit Hooks: Immediate feedback
Pipeline Scans: Delayed feedback

Resource Usage
Pre-commit Hooks: Your local machine
Pipeline Scans: CI/CD infrastructure

Depth
Pre-commit Hooks: Surface-level scanning
Pipeline Scans: Deep vulnerability analysis

Why You Need Both

The lightbulb moment came when I realized this isn't about choosing one or the other, it's about defense in depth. Each approach catches different types of security issues at different stages of development.

Pre-commit Hooks: Your First Line of Defense

Pre-commit hooks excel at catching the "oops" moments:

# This gets caught immediately by pre-commit
API_KEY = "sk-1234567890abcdef"  # Secrets scanner stops this cold

Pipeline Scans: Your Security Net

Pipeline scans catch the deeper, more complex issues:

// This gets caught by Snyk in your pipeline
{
  "dependencies": {
    "lodash": "4.17.15"  // Known vulnerability CVE-2020-8203
  }
}

The Ideal Security Setup

After working with both approaches, I've found the best strategy combines them strategically:

Pre-commit Hooks Handle:

  • Preventing secrets from ever entering your repository
  • Fast feedback during active development
  • Code quality enforcement
  • Lightweight security checks that don't slow down your workflow

Pipeline Scans Handle:

  • Vulnerability assessment of all dependencies
  • Container and infrastructure security analysis
  • Compliance reporting and integration with security tools
  • Deep static analysis that requires more processing power

Putting It All Together

Here's what a complete security scanning setup looks like:

# .pre-commit-config.yaml (Local, Fast)
repos:
  - repo: https://github.com/Yelp/detect-secrets
    hooks:
      - id: detect-secrets
  - repo: https://github.com/PyCQA/bandit
    hooks:
      - id: bandit

---
# .github/workflows/security.yml (Pipeline)
name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Snyk
        uses: snyk/actions/node@master
      - name: Container scan
        run: docker scan myapp:latest
      - name: SAST scan
        uses: github/codeql-action/analyze@v2

Conclusion

What initially seemed like redundant tooling actually represents a thoughtful, layered security approach. Pre-commit hooks are your immediate feedback system that prevents obvious security mistakes from entering your codebase. Pipeline scans are your security assessment that ensures nothing slips through the cracks.

Rather than choosing between them, the question should be: "How can I implement both effectively?" The combination gives you the best of both worlds. Fast, local feedback for developers and thorough, enterprise-grade security analysis for your entire application stack.

If you're just getting started with DevOps, I'd recommend beginning with pre-commit hooks for the immediate developer experience benefits, then gradually adding more advanced pipeline scanning as your security maturity grows. Your future self (and your security team) will thank you for implementing both.

Tags

cybersecuritydevops