GitHub's secret classifier enters private preview for push protection

GitHub’s changelog for 7 October 2026 and an essay the same day by Erin Havens, a GitHub product manager, describe a fine-tuned model that scores likely credentials from surrounding code. AI push protection is in private preview.

What a blocked push prevents

Push protection blocks a git push that contains a secret before that secret is written into history. Removing it from the newest commit leaves older commits as they were. Havens says today’s check stops “recognizable credentials before they enter repository history.”

A recognizable secret has a pattern, often a vendor prefix. A database password may have none, so a regular expression built for a known token shape misses it, and a looser pattern also flags placeholders in examples. Havens writes: “An internal database password may be completely unstructured, with no identifying pattern at all.” The changelog says the model “reads surrounding code to identify likely credentials, including passwords without a recognizable token format.”

A label, not new text

The model is a classifier. It labels a candidate and, the changelog says, works “without generating code or prose.” An LLM that writes code produces new text. The essay calls this detector “Our new ModernBERT classifier” and “the fine-tuned classifier we built with Microsoft Applied Sciences.” The changelog uses neither name.

Speed and coverage are GitHub’s claims. The essay says batches are scored in under two milliseconds, and that the model “makes it possible for us to more than double the number of secrets that we’re able to prevent.” GitHub’s 8 October post repeats both. The essay’s “about 30%” is today’s baseline: with more secret types counted, push protection “stops about 30% of newly detected secrets before they enter repository history.”

Plans, credits, and the server

Private preview is now, on both pages. “Later this month,” for GitHub Secret Protection on Enterprise Cloud and GitHub Teams, is the essay. The changelog requires GHSP or GHAS on GitHub Enterprise Cloud or GitHub Teams, and “an administrator must enable it.” On github.com that includes public, private, and internal repositories. On ghe.com, AI push protection “is planned” with the same paid coverage.

Alerts after a push stay in GHSP and GHAS at no extra charge, and AI-detected Password alerts “have automatically been upgraded.” AI Credits, “introduced in the coming weeks,” apply to the opt-in push check and to new /security-review secret checks, even when the push is allowed. The owning organization is billed, except an enterprise-managed user’s namespace repository, billed to the pusher. Billing starts at public-preview opt-in. Disable the check first if you do not want that spend. Budget the Secret Protection AI Credits SKU. An alert does not stop usage. “Stop usage when budget limit is reached” does, where that control exists.

GHES 3.23 is the alerts path, not this block. The essay says public preview brings AI-detected alerts to Secret Protection customers “even in air-gapped environments.” The changelog says AI push protection is not part of that Server release, and neither is the Copilot review command. The alerts are included with existing GHSP or GHAS.

The review command

On the Copilot CLI and app, /security-review secret checks are “available soon in private preview,” beside the language-model review. No GHSP or GHAS licence is required. They stay off until an opt-in. Running the command does not enable them, and they add AI Credits to the review’s current use. The table lists Copilot Pro, Pro+, Max, Free, and Student, plus Business and Enterprise on supported platforms, under invitation, admin policy, and credits. Copilot does not replace GHSP for a blocked push. The CLI agent and app session docs describe today’s review, not the classifier.

Before enabling the wider preview, confirm the GHSP or GHAS licence, the admin switch, and whether AI Credits should be spent on allowed pushes as well as blocked ones. The sub-2 ms timing and the doubling forecast are GitHub’s claims.