GitHub now blocks commits that contain Anthropic API keys through push protection by default, and it added Salesforce as a secret scanning partner.
The October 13 changelog entry says secret scanning now detects new secret types from Salesforce, Anthropic and Cloudsmith. Two Anthropic types, a service API key and a user API key, are included in push protection by default. Repositories with secret scanning enabled, including free public repositories, will have commits containing those secrets blocked automatically.
Salesforce is now a secret scanning partner. GitHub says that when a provider’s secret turns up in a public repository, it forwards the finding to the partner so the credential can be revoked or rotated before it is abused. The changelog lists a Salesforce Marketing Cloud API OAuth2 token as the new Salesforce type, and a Cloudsmith API key as the new Cloudsmith type. Partner secrets are reported to the issuer automatically when found in public repositories, while user secrets generate alerts in public or private repositories.
The default matters because a blocked push is the cheapest point to stop a leak, before the key is committed. Repositories with secret scanning enabled get that protection for the Anthropic types without a configuration change. Private repositories get alerts for the new types, though the partner notification applies to public repositories.
In our reading, the new types are a prompt for an inventory. List which AI and marketing services hold keys in your pipelines, confirm each one has a detector, and make sure rotation procedures exist for the ones that do not. A blocked push tells a developer a key was almost leaked, and a rotation runbook covers the keys that already were.
The change follows GhostAction’s sweep of 345 repositories, which we covered, and sits beside the npm trusted publishing change we reported on October 13.
Source: GitHub Changelog, Secret scanning blocks Anthropic keys by default, adds Salesforce
