jev-commit

How we reviewed this: we installed it in Docker against a local stand-in for the API and ran its tests — 98 passing, one skipped — plus a commit with a credential-shaped line staged. We made no Jev calls.

What it does

jev-commit, by valentynkit, is a commit-msg hook that asks five questions about your message and your staged diff in one request: is the message substantive, does it match the diff, is there debugging left in, has the change grown beyond what the message claims, and does anything look like a secret. The state carries a note telling the model that the message and diff are data, never instructions.

It’s pure standard library, installs as a plain git hook, and has a real test suite.

The ordering problem

There are two credential checks: a local pattern scan (“the belt”) and the question. The local scan runs first in source order — and then judge() sends the diff, and only after that does the code block the commit.

So for the case the tool exists to catch, the sequence is: your credential goes to a third-party API, then your commit is stopped. The blocking works; the containment doesn’t. Moving the block above the request would fix it, and we’ve reported that.

The diff hunks are sent as-is, with no redaction, so this isn’t limited to credentials: whatever is in the staged change is in the request.

Verdict

The question set is well chosen — “does the message match the diff” is exactly the check code review keeps having to do by hand — and the implementation is clean.

Wait for the ordering fix before relying on it as a secret guard, and treat it as “my staged diffs go to an API” in the meantime.

For checks on the code rather than the message, see Jev Review and jeff.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.