We built a pre-push gate that runs linters, secret and SAST scans, containerised tests and an LLM review of the diff before code leaves a laptop. The hard parts were not the model call: ordering, cost caps, redaction, fail-open rules and keeping CI as the real authority.
We added five scanners to CI and within a week developers were merging with admin override. This is the gate design we rebuilt: block only new, fixable, high-signal findings on PRs, scan everything nightly, and make exceptions expire.
A developer committed a .env file with a live AWS access key, then deleted it in the next commit. The key stayed in history. We revoked it within 40 minutes, checked CloudTrail, rewrote history with git filter-repo and added scanning so it cannot happen again.