GitHub's push protection gets an AI classifier for passwords that pattern matching misses

Push protection acts at one point. It can block a push before a credential enters repository history ^[2]. Everything it misses is detected after exposure ^[10]. By then the credential can give someone access to a database, a cloud service or another connected system, and the owner has to replace it and check whether it was misused ^[11]. Some service providers revoke credentials automatically when GitHub reports an exposure ^[13].

The model, built with Microsoft Applied Sciences ^[1], is aimed at credentials with no fixed format. A database password with no recognizable pattern gets past format checks ^[3]. GitHub's push statistics have the same limit: they cover supported provider patterns, including GitHub's own tokens ^[9]. Unstructured passwords sit outside those figures by definition ^[3][9].

Leak counts are tracking code volume ^[7][8]. GitHub says a new secret appears in publicly visible code roughly every two seconds ^[6]. At that rate, about 43,200 appear each day ^[20]. From the second quarter of 2024 to the second quarter of 2026, the public pushes GitHub screened rose 2.84-fold and pushes containing credentials rose 2.59-fold ^[7]. Over those nine quarters GitHub found no statistically detectable trend in the share of pushes carrying secrets ^[8].

"Push protection intervenes earlier. It stops recognizable credentials before they enter repository history, giving the developer or agent a chance to correct the change before there's an exposure to investigate," Erin Havens, a product manager at GitHub, wrote ^[4]. Her statement counts agents as well as people among those pushing code ^[4]. The word "recognizable" describes the coverage push protection already had. The classifier is meant to extend the block to credentials a pattern cannot recognize ^[3].

Latency looks handled. GitHub says the model evaluates batches of candidate secrets in under two milliseconds ^[21]. Accuracy is harder. GitHub says false alarms can interrupt developers and undermine trust in future warnings, and that detection has to balance accuracy, speed, processing capacity and operating costs ^[5]. The announcement does not include a false-positive rate, and the claim that the classifier could more than double the secrets push protection prevents is GitHub's own projection ^[22].

Blocking at push consumes AI credits ^[15]. Alerts from scans after a push remain included in the secret scanning purchase at no additional cost ^[17]. GitHub has begun moving organizations already using AI secret detection to the new model automatically ^[16]. It is also adding the classifier to the /security-review command in Copilot CLI and Copilot App, letting Copilot users check for secrets before pushing without their organization holding a Secret Protection plan ^[19]. That credit use is attributed to GitHub Secret Protection in AI usage insights ^[19].