For this particular example, I have a .cfg file (structured like any INI file), that I am using from inside a Python application, that stores API keys for experimentation. Before committing the code, I want to always remove these keys from the file. What this does is essentially tell git , that every time files are added to the commit (i.e. with git add ), run the filter called securekeys .