GitHub says a small classifier now filters its generic secret detections, cutting median post-push scan time by 86% against its earlier LLM-based pipeline.
In an October 13 engineering post, Batu Ozturkler and Shengyu Fu describe a two-stage scanner. Regular expressions first pull out anything that looks like a credential. A fine-tuned ModernBERT model then scores each candidate using its file path, credential type, variable names and the code around it, and lookalikes such as placeholders, test fixtures and checksums are filtered out before alerting. GitHub reports an 11.5% rise in weighted acceptance and a serving cost more than 98% below the LLM calls it replaced.
The speed gain changes where the check can run. GitHub says the faster model made it practical to extend generic secret detection to push protection, so a developer gets a result before a push is accepted and not only after code is committed. Generic secrets may lack a distinctive prefix or checksum, which makes false alarms hard to avoid, and the post says each new exclusion rule risks hiding a real credential.
For a security team, the change matters on two fronts. Fewer false positives mean fewer ignored alerts, and a check at push time can stop a credential before it reaches the repository. In our reading, each team should decide how it treats a blocked push, since a developer who can bypass the prompt without review leaves the new control half used. Review who may override push protection and where those overrides are logged.
We covered the cost of a leaked token in a leaked GitHub secret that erased an Azure tenant, and GitHub’s tightening of npm trusted publishing configurations sits in the same supply chain.
