GitHub rebuilds secret scanning to cut noise and speed checks

The faster system lets generic secret detection run in push protection, so likely secrets can be caught before code is accepted.

GitHub says it rebuilt secret scanning around a two-step system that first flags credential-like strings with regex and then uses a fine-tuned ModernBERT classifier to decide whether the candidate is really a secret, which matters because better precision reduces developer toil without missing real credentials. The company says that change cut median post-push scan time by 86% versus its earlier LLM-based pipeline, improved user acceptance by 11.5%, and delivered more than 98% cost savings. The new classifier also made it practical to bring generic secret detection into push protection, so findings can appear before a push is accepted instead of only after code is committed. GitHub says the model is meant to handle hard negatives such as placeholders, examples, test fixtures, checksums, and other lookalikes by using surrounding file and code context rather than just pattern matching.