Share with your CISO
GitHub is shipping a purpose-built AI model specifically trained to detect leaked secrets in code, and it’s doing so across three distinct enforcement points: post-commit alert scanning, push-time blocking, and the Copilot /security-review command. Existing customers on GitHub Secret Protection and GitHub Advanced Security get the upgraded alert scanning model at no additional charge. The new push protection and security-review checks consume GitHub AI Credits, billed to the organization. Enterprise Server users get AI-detected alerts in GHES 3.23. The new checks are off by default and require explicit administrator opt-in.
What this means for your business
The hard problem in secret detection has never been finding API keys with recognizable formats. It’s been catching passwords and unstructured credentials that look like ordinary strings. A developer hardcodes a database password as “Summer2024!” and no pattern-matching scanner flags it. GitHub’s model reads surrounding code context to infer probable credential status, which is the detection gap that has caused most of the high-profile secret exposure incidents in enterprise repositories over the last five years.
The billing structure here deserves scrutiny before anyone clicks enable. AI Credit consumption for push protection is billed per check, even when no secret is found and no push is blocked. In a large engineering organization with hundreds of daily pushes, that cost accrues quietly. GitHub’s own guidance is explicit: budget alerts alone don’t stop usage, and you must configure a hard spending cap separately. The organizations that skip this step will discover the bill weeks after the fact, which is the exact same pattern that burned teams during early cloud adoption.
The signal worth watching is how GitHub prices the Copilot security-review integration over time. Right now, individual Copilot Pro users can access the secret checks without a GHSP or GHAS license. That’s a deliberate land-and-expand move, pulling security capability into the developer-seat license rather than the separate security product. If GitHub converts enough individual usage to enterprise security tooling demand, it reframes the CISO’s budget conversation entirely. The question is whether security teams will tolerate detection controls that live inside a developer productivity subscription they don’t directly control.
Concept deep-dive: Context-aware secret detection
Traditional secret scanning matches tokens against known patterns, such as the fixed prefix structure of an AWS access key or a Stripe API key. Context-aware detection works differently: the model reads the code surrounding a string to judge whether it’s functioning as a credential, even without a recognizable format. Think of it as the difference between a spell-checker that flags unknown words and an editor who understands that “open sesame” is a password in context. For enterprises, the business consequence is catching the credentials that compliance scanners have always missed.
Based on reporting from Purpose-built model for leaked secret detection, originally published 2026-10-07 12:13:00.
