# Run five checks before merging AI-written code

> Check secrets, unused code, duplication and dependencies, then put repeatable checks in hooks.

Source: https://fullbytedeveloper.com/blog/check-ai-code-before-merging
Keyword: MERGEGATE
Published: 2026-11-05

Gitleaks, Knip, jscpd, OSV-Scanner and Lefthook cover different parts of a review. Their documentation describes secret detection, unused-code analysis, duplicate-code detection, dependency scanning and Git hooks respectively [1][2][3][4][5].

## Scan the repository for secrets

On macOS with Homebrew, Gitleaks documents this installation. Run the scan from your repository [1].

```bash
brew install gitleaks
gitleaks git -v
```

Review each finding before sharing scan output: it can contain the secret that was found [1].

## Check unused code and duplication

Follow Knip's setup for your JavaScript or TypeScript project. Review its reported entry points before removing anything it considers unused [2].

For duplication, jscpd documents a one-off scan [3].

```bash
npx jscpd .
```

Use the duplicate locations to inspect the code. Similar text can still serve different behavior.

## Scan dependency files

Install OSV-Scanner using its documented installation for your system. Its source scan walks supported package files [4]. Replace the example directory with your checkout.

```bash
osv-scanner scan source -r /path/to/your/dir
```

## Keep the useful checks in hooks

Lefthook runs commands you define in `lefthook.yml`. After configuring those commands, its README installs them into the Git project with [5]:

```bash
lefthook install
```

Keep your application's tests in the review too. These tools report particular problems; a clean scan does not prove the feature works.

## Sources

1. [Gitleaks repository: installation and commands](https://github.com/gitleaks/gitleaks)
2. [Knip: getting started](https://knip.dev/overview/getting-started)
3. [jscpd repository: quick start](https://github.com/kucherenko/jscpd)
4. [OSV-Scanner repository: source scanning](https://github.com/google/osv-scanner)
5. [Lefthook repository: usage](https://github.com/evilmartians/lefthook)

## Original posts

- [Instagram reel](https://www.instagram.com/reel/DfNU_Z9gk5b/)
- [Facebook reel](https://www.facebook.com/reel/2266600434197441)
- [Threads post](https://www.threads.com/@fullbytedeveloper/post/DfNVFfnFgkq)
- [TikTok video](https://www.tiktok.com/@fullbytedeveloper/video/7703264755217091860)