Home
Latest reporting
News
GitHub says a ModernBERT-based secret classifier improved weighted acceptance 11.5% and cut median post-push scan time 86%.
GitHub said its new context-aware secret classifier is improving secret scanning quality while lowering execution costs, with a two-stage pipeline that combines deterministic regex candidate generation and a fine-tuned ModernBERT model for context-based classification.
Evidence and context
In a post published on Oct. 13, 2026, GitHub described the scanner as a replacement for a previous LLM-based pipeline in the secret detection stack. The company said the new system produced an 11.5% improvement in repository owner-weighted acceptance, an 86% reduction in median post-push scan execution time, and more than 98% lower serving cost versus the remote LLM approach.
GitHub said the pipeline is designed to address a common problem in secret scanning: strings that resemble credentials but are actually harmless placeholders, documentation examples, checksums or generated values. According to the company, regex filters first generate candidate secrets with high recall, and a compact ModernBERT classifier then evaluates each candidate together with its file path, secret type and surrounding code or text. High-confidence findings are surfaced as alerts, while likely false positives are suppressed before reaching developers.
The company said offline evaluation on post-push scanning showed 13% higher precision and 19% higher recall than the prior LLM pipeline on the same public traffic. It then validated the system in a customer A/B experiment, where repository owner-weighted acceptance increased by 11.5%. GitHub said the owner-weighted measure reduces distortion from customers who bulk-resolve large numbers of alerts at once.
GitHub also said the lower-latency classifier made it practical to extend generic secret detection to push protection, which scans before a push is accepted. Background material provided with the announcement notes that push protection is distinct from post-push scanning and that detection coverage can still be affected by supported token versions, scan timeouts and push-size limits.
Why it matters
The company framed the change as an attempt to improve trust in secret-scanning alerts by reducing noise without giving up recall. GitHub said the system is intended to catch generic secrets that do not have distinctive structured formats, while still filtering out hard negatives such as test fixtures, placeholders and non-sensitive identifiers.
The announcement follows related GitHub changelog updates dated Oct. 5, Oct. 7 and Oct. 13, 2026, which added detectors and expanded context-aware secret detection. The Oct. 7 note said the purpose-built model for leaked secret detection was added as a changelog item, while the Oct. 13 update said secret scanning blocks Anthropic keys by default and adds Salesforce. The GitHub blog post did not provide a date for wider rollout beyond the publication date of Oct. 13, 2026, and did not specify a customer count or deployment scope beyond the reported evaluations.
GitHub said future work will focus on continuous feedback loops to improve the training data and on exploring model architectures that can combine detection and extraction in a single step. The company did not provide a timing estimate for those efforts.
Source: github.blog.
Reporting source
github.blog
Original reporting or announcement. Other cited links provide additional evidence; a source link alone does not establish independent verification.
