GitHub announced on October 7, 2026 that it built a ModernBERT classifier with Microsoft Applied Sciences to extend push protection to unstructured secrets. The model examines candidate credentials in their surrounding code rather than relying only on recognizable token formats.
GitHub says the classifier evaluates batches of candidate secrets in under two milliseconds and could more than double the number of secrets it can prevent from entering repository history. These are GitHub's reported performance and potential-coverage claims, not independent benchmarks or a guarantee that all leaked credentials will be blocked.
Expanded push protection is currently in private preview. GitHub plans availability later in October for organizations with GitHub Secret Protection on Enterprise Cloud and GitHub Team plans. That feature will consume AI credits; the announcement does not make it free for every account today.
Organizations already using AI secret detection began receiving the new model automatically. GitHub says alerts from post-push scans remain included with an organization's secret-scanning purchase at no additional cost. Post-push alerts and blocking a credential before a push are different capabilities.
GitHub also plans a public preview in Enterprise Server 3.23, including AI-detected alerts for Secret Protection customers in air-gapped environments. It is adding the classifier to the security-review command in Copilot CLI and Copilot App so users can check for secrets before a push without an organization's Secret Protection plan.
The announcement is about detection and prevention, not permission to retrieve or share credentials. GitHub's broader analysis reports growing code volume without a statistically detectable rise in per-push secret prevalence across nine quarters. That distinction does not support a blanket claim that developers have become more careless.