Code context becomes part of the check
GitHub announced a ModernBERT-based classifier October 7 for detecting secrets that lack a familiar token format. The company says the model evaluates candidate values in their surrounding code and does not generate code or prose. It reports evaluation of candidate batches in under two milliseconds; that is a vendor performance claim, not an independently measured result.
Check the rollout before promising coverage
GitHub says existing organizations using AI secret detection are being moved to the model. Its use in push protection is in private preview, with broader availability for eligible Teams and Enterprise Cloud customers planned later in October and consumption of AI credits. The announcement also describes plans for other developer surfaces. Buyers should distinguish capabilities already enabled in their organization from announced future availability.
A block needs an operational response
For retailers, publishers and telecommunications teams maintaining custom software, our assessment is that prevention is useful only when developers know what to do with a blocked change. Establish who reviews a suspected credential, how a false positive is documented and who can approve an exception. Keep that route short enough to work during a time-sensitive release. If a value is a real credential, removing it from the latest edit should not become an assumption that no earlier exposure occurred. The team needs an owner who can assess where it was used and coordinate the appropriate replacement process.
Evaluate the workflow as well as the detector
A pilot can compare a representative set of repositories and record both useful blocks and interruptions that require manual review. Include human-written and automated changes, and track how long each finding takes to resolve. Avoid using the number of alerts as the sole success metric. For an agency or MSP maintaining code for several customers, define which party owns the credential and which party receives the alert before turning on a new control. That division of responsibility matters as much as the scanner’s interface: a correctly detected secret can still remain active if the notification lands with a team that cannot replace it.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
