shield npm publish?

[andrewharvey]

Are you likely to extend this to npm publish?

I'm embarrassed to admit I've accidentally leaked secret keys through npm not realising npm publish takes the whole directory including files not staged!

[agius]

Hey @andrewharvey ! Thanks for the question. What about adding a secret-shield run to prepublish or prepublishOnly scripts in your package.json ? That should cancel the publish if secret-shield finds anything. Is the ask here to automate the setup of that via the binary?

[andrewharvey]

Oh that's true, that approach should work well, thanks.

[elfakyn]

Opening for adding to documentation.