GitHub reports faster secret scanning with more than 98% cost savings

GitHub says its new credential scanner reduced median post-push scan execution time by 86% and serving costs by more than 98% compared with its previous pipeline based on a large language model. The speed improvement made it practical to check generic secrets before accepting developers' code pushes. The scanner first uses pattern matching to identify possible credentials. A fine-tuned ModernBERT model then examines nearby code, variable names and file paths to distinguish usable secrets from placeholders and other lookalikes. GitHub measured 13% higher precision and 19% higher recall on the same public traffic. In a customer A/B experiment, repository owner-weighted alert acceptance increased by 11.5%; the model still classifies credential likelihood rather than verifying usability.