diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..2ad03e9
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,19 @@
+# Pre-commit secret scanning for whytho (same approach as usernaut / template-ui).
+#
+# Install: pip install pre-commit && pre-commit install
+# Run manually: pre-commit run --all-files
+#
+# Also enable GitHub Secret Scanning + Push Protection on the repo:
+# https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
+# https://docs.github.com/en/code-security/concepts/secret-security/push-protection
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: detect-private-key
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.28.0
+    hooks:
+      - id: gitleaks
diff --git a/README.md b/README.md
index a443770..77bf405 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,15 @@ git clone https://github.com/vinamra28/whytho.git
 cd whytho
 ```
 
-### 2. Configure Environment Variables
+### 2. Install pre-commit (recommended)
+
+```bash
+pip install pre-commit && pre-commit install
+```
+
+Hooks run `gitleaks` and `detect-private-key` on commit. Also enable [GitHub Secret Scanning](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) and [Push Protection](https://docs.github.com/en/code-security/concepts/secret-security/push-protection) on the repository for defense in depth.
+
+### 3. Configure Environment Variables
 
 Copy the example environment file and fill in your credentials:
 
@@ -52,13 +60,13 @@ WEBHOOK_SECRET=your_webhook_secret_here
 PORT=8080
 ```
 
-### 3. Install Dependencies
+### 4. Install Dependencies
 
 ```bash
 go mod tidy
 ```
 
-### 4. Run the Application
+### 5. Run the Application
 
 #### Option A: Direct Go Run