GitHub announced an AI-powered secret detection tool built with Microsoft Applied Sciences that relies on a ModernBERT-based classifier. Help Net Security and Cyber Security News covered the announcement, as did the GitHub Blog. The tool expands existing push protection by analyzing the code around potential secrets to catch credentials that lack regular patterns.
The classifier processes groups of candidate secrets in under two milliseconds and can increase the number of credentials blocked before they enter repository history by more than double. Help Net Security and Cyber Security News report this performance gain. The speed allows the tool to scan large batches of code without noticeable delay for developers.
GitHub said the expanded push protection will be available later in October for organizations that have GitHub Secret Protection on Enterprise Cloud or Team plans. Help Net Security, Cyber Security News and the GitHub Blog note that usage will consume AI credits. The rollout begins with a private preview before broader availability.
For organizations already using AI secret detection, GitHub is automatically updating them to the new model. Help Net Security and the GitHub Blog state that post‑push alert scans remain included in the secret scanning at no extra cost. This approach aims to reduce disruption for existing customers.
The model will also ship in public preview with GitHub Enterprise Server 3.23, providing AI‑detected alerts to Secret Protection customers, including those in air‑gapped environments. Help Net Security and the GitHub Blog report this extension to on‑premise deployments. The move targets enterprises with strict data residency or compliance requirements.
GitHub is adding the classifier to the /security‑review command in Copilot CLI and Copilot App. Help Net Security and the GitHub Blog explain that this lets Copilot users check for secrets before pushing code even if their organization does not have a Secret Protection plan. GitHub Secret Protection attributes AI credit consumption from these scans in usage insights.
From Q2 2024 to Q2 2026, the number of public code pushes screened by GitHub rose by a factor of 2.84, while pushes containing credentials increased by a factor of 2.59. Help Net Security and Cyber Security News provide these growth figures. The data show that push volume expanded faster than the volume of risky pushes.
Over the same period, the share of pushes that contain secrets showed no statistically detectable trend. Help Net Security and Cyber Security News note this stability. The absolute number of exposed credentials grew in line with the rise in total push volume.
Currently, push protection blocks about 30% of newly detected secrets before they enter repository history, with the remaining 70% caught after exposure. Help Net Security and Cyber Security News give these percentages. The gap highlights where additional pre‑commit checks could have impact.
When attackers leak a credential, manual revocation takes roughly 40 days on average, and about one in five secrets remain exposed for more than 90 days. Help Net Security and Cyber Security News report these remediation timelines. The delay creates a window during which attackers could misuse the exposed secret.
By catching credentials earlier, the tool aims to shrink the period between exposure and remediation, which can limit the time available for attackers to misuse leaked secrets. This follows from the average 40‑day remediation window and the fact that one in five secrets stay exposed beyond 90 days. The reduction in exposure time is a security consideration for developers and supply‑chain defenders.
Integrating the classifier into Copilot’s /security‑review command brings secret scanning into tools developers already use, potentially reducing friction for adopting security checks. Help Net Security and the GitHub Blog note that the check does not require a Secret Protection plan, widening access. GitHub Secret Protection tracks AI credit usage from these scans in usage insights.
What to watch next includes how organizations adopt the AI credit model, whether the classifier shifts the proportion of secrets blocked before they enter repository history, and how the Copilot integration affects developer security habits over time. Help Net Security, Cyber Security News and the GitHub Blog say that the expanded push protection moves from private preview to general availability later in October. The public preview with Enterprise Server 3.23 will extend the feature to on‑premise and air‑gapped environments.
Join the discussion