Topic
Practice of detecting exposed credentials and tokens in source code or repositories, using pattern matching, entropy analysis, and verification checks.
GitHub added Anthropic service and user API keys to push protection defaults on October 13, but a push is blocked only where secret scanning is enabled. Teams whose agents push config need to check coverage per repository, private ones included.
Reality
GitHub says a fine-tuned ModernBERT classifier cut median post-push secret-scan time by 86% and model serving costs by over 98% against its LLM pipeline. The speed also let it extend generic secret detection to push protection.
Reality
GitHub's Oct. 13 changelog adds two Anthropic key types, user and service, to the secrets push protection blocks by default. A private repository on default settings still gets no block, according to a dev.to analysis of the entry.
Reality
GitHub says adding an AI classifier to push protection could more than double the secrets it can stop, by spotting passwords that have no fixed format. Push protection now stops about 30% of newly detected secrets before they reach repository history.
Reality
Truffle Security scanned 224 million public GitHub repositories and found 543,699 credentials still working in July, exposed for a median 784 days. Push Protection screens only new pushes in known formats, so owners have to rotate the backlog themselves.
Reality
On July 22 a model wrote a forty-character API key into a page's JavaScript and declared the API not secret. GoodBarber now has the model state only how a key is sent and lets code default every key to secret.
Reality
The policy lives in a JSON file a reviewer can read without reading the code, and the gate resolves overlapping matches by severity, so a JWT found inside a log line is denied instead of merely warned on.
Reality
The gate between Claude Code's self-written audit memos and one developer's Obsidian wiki scans only the four files it intends to copy, tests them against two credential prefixes, and exits 2 on the first match.
Reality
Plain API keys leak more than any other credential and still have no standard kill switch, so a draft called ORKS copies OAuth's discoverable revocation endpoint and lets the person who found the key pull it.
Reality
A Go secret scanner sped up its Shannon entropy stage by rewriting the formula and precomputing a 4 KiB table, with no CGo, no unsafe, and no heap allocations.
Reality