diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100644
index 00000000..f674e88f
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,19 @@
+#!/bin/sh
+# Red Valley: every commit needs a changelog and must not add obvious secrets.
+
+if git diff --cached --quiet; then
+  exit 0
+fi
+
+if git diff --cached --quiet -- CHANGELOG.md; then
+  echo "Commit blocat: actualizeaza si adauga CHANGELOG.md la fiecare commit." >&2
+  exit 1
+fi
+
+if git diff --cached --unified=0 -- . ':(exclude)CHANGELOG.md' |
+  grep -E '^\+[^+].*(rcon_password|sv_licenseKey|mysql_connection_string|webhook_url|discord_webhook|api[_-]?key|access[_-]?token)([[:space:]]*[:=][[:space:]]*|[[:space:]]+)[^[:space:]"]+' >/dev/null; then
+  echo "Commit blocat: posibil secret detectat in staged diff." >&2
+  exit 1
+fi
+
+exit 0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index da1260b4..450b911e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -40,3 +40,5 @@ secretele nu fac parte din commituri.
   `*.backup-*` / `*.bak-INC*` sunt ignorate explicit.
 - Logurile consolei urmărite anterior sunt scoase numai din indexul Git; rămân
   intacte pe discul DEV pentru diagnostic.
+- Hook-ul local `pre-commit` cere o intrare în `CHANGELOG.md` la fiecare commit
+  și blochează tipare evidente de credentiale adăugate accidental.