diff --git a/routers/private/hook_pre_receive.go b/routers/private/hook_pre_receive.go
index e7ccff06e8..0da5d3a65b 100644
--- a/routers/private/hook_pre_receive.go
+++ b/routers/private/hook_pre_receive.go
@@ -154,7 +154,9 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 
 	if newCommitID != objectFormat.EmptyObjectID().String() {
 		newCommit, err := gitRepo.GetCommit(newCommitID)
-		if err == nil {
+		if err != nil {
+			log.Error("Secret scan: failed to get commit %s in %-v: %v", newCommitID[:12], repo, err)
+		} else {
 			if findings := security_service.ScanPushForSecrets(ctx, repo.ID, newCommit); len(findings) > 0 {
 				msg := fmt.Sprintf("Push rejected: %d secret(s) detected in commit %s", len(findings), newCommitID[:12])
 				for _, f := range findings {