GitHub rolls out new secret detector and previews checks before code uploads

GitHub says it is automatically updating organizations with AI secret detection to a new ModernBERT classifier, while testing its use in push protection in private preview. The model checks potential credentials in their surrounding code, including passwords without recognizable patterns, and evaluates batches in under two milliseconds. Existing post-upload scanning alerts remain included at no additional cost. Checks that block uploads are scheduled to reach GitHub Secret Protection organizations on Enterprise Cloud and GitHub Teams later this month and will consume AI credits. GitHub says the classifier could more than double the secrets it prevents; its current protection stops about 30% of newly detected secrets before they enter repository history.