diff --git a/.gitignore b/.gitignore
index 2c181a0..526e8b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,7 +11,10 @@
 **/*mnemonic*
 # Only ignore root-level validator-keys/ if created outside devnet
 /validator-keys/
-
+# Critical: auto-generated nodes-summary.json contains private keys
+devnet/besu-config/nodes-summary.json
+# Do NOT commit raw validator key files anywhere under devnet/
+devnet/validator-keys/**/key
 # Build artifacts
 **/out/
 **/build/
diff --git a/.pre-commit-secret-scan.sh b/.pre-commit-secret-scan.sh
new file mode 100755
index 0000000..fa42096
--- /dev/null
+++ b/.pre-commit-secret-scan.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# .pre-commit-secret-scan.sh — lightweight secret scanner for JCC repo
+# Run this as a pre-commit hook or in CI to prevent private-key leakage.
+# Usage: ./.pre-commit-secret-scan.sh [file-list...]
+
+set -euo pipefail
+
+EXIT_CODE=0
+
+# Patterns that indicate high-confidence secrets
+PATTERNS=(
+  # 64+ hex digits on a line (private key, seed)
+  '[0-9a-fA-F]{64,}'
+)
+
+FILES="${@:-$(git diff --cached --name-only --diff-filter=ACM)}"
+
+for file in $FILES; do
+  # Skip binary files
+  if file "$file" | grep -q 'binary'; then
+    continue
+  fi
+  # Skip files in allowed directories (documentation only)
+  case "$file" in
+    docs/*|README*|*.md)
+      continue
+      ;;
+  esac
+  # Check for hex private key pattern
+  if grep -nEi '[0-9a-f]{64,}' "$file" 2>/dev/null; then
+    echo "ERROR: Potential secret detected in $file (64+ hex string)."
+    EXIT_CODE=1
+  fi
+done
+
+if [ "$EXIT_CODE" -ne 0 ]; then
+  echo "Commit blocked. Remove secrets or add to .gitignore if safe."
+fi
+
+exit "$EXIT_CODE"