GitHub’s model for secret detection: Finding more secrets with less noise

GitHub has introduced a context-aware secret scanning pipeline that combines high-recall regex candidate detection with a fine-tuned ModernBERT classifier to distinguish likely real credentials from harmless lookalikes such as placeholders, test fixtures, checksums, and documentation examples. Designed to complement rather than replace deterministic scanning, the classifier evaluates candidate strings alongside file paths, variable names, secret types, and surrounding code or text, enabling generic secret detection in both post-push scanning and push protection. Training used validated product-derived data, annotated and weakly labeled regex candidates, and quality-reviewed synthetic examples, with safeguards to prevent related examples from appearing across training and evaluation sets. Compared with GitHub’s prior remote LLM-based pipeline, production and A/B evaluations reported 11.5% higher repository owner-weighted alert acceptance, an 86% reduction in median post-push scan execution time, and more than 98% lower serving costs, while offline testing showed higher precision and recall. GitHub plans to improve the system through production feedback loops and to explore architectures that combine secret detection and extraction in one step.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.