GitHub uses a small classifier to make secret scanning faster

GitHub combines broad regex matching with a fine-tuned ModernBERT model that reads candidate secrets alongside filenames and surrounding code. It reports 86% lower median post-push scan execution time and over 98% lower serving cost than its previous LLM pipeline. The smaller model also enables checks before a push is accepted. These are GitHub’s workload-specific results, not universal detection guarantees.

GitHub · Oct 13, 2026

Why it matters

A narrowly trained classifier can outperform a general model operationally when the decision is well defined.

More context

Read the training and evaluation discussion for handling plausible-looking nonsecrets. Review your repository’s secret-scanning and push-protection settings; do not assume an AI coding tool replaces those controls.

Keep in mind

Context reduces false alerts but cannot guarantee that every real credential will be found.

Original read