What GitHub measured when it swapped secret-scanning models

What the October 13 post measured

On October 13, 2026, GitHub published a post on a context-aware secret classifier. It says a fast classifier reduced median post-push scan execution time by 86 percent compared with the previous large-model pipeline, and that the cost of serving the compact classifier is more than 98 percent lower. It also says repository-owner-weighted acceptance of findings rose 11.5 percent, a weighting GitHub says is meant to keep customers who resolve alerts in bulk from dominating a simple average. The page filing those measurements isFutureweb.

What the pipeline is, at the level the post states

The post describes two stages. Regular expressions scan for candidate secrets at high recall. A fine-tuned ModernBERT classifier then looks at the candidate and its surroundings, including placeholders, examples, and documentation, and decides whether the candidate is worth an alert. This page does not reprint patterns, and it does not describe how to hide a credential from the scanner. The desk isSoftware.

What the October 7 note already promised

Six days earlier, GitHub's changelog said customers with AI-detected password alerts were being moved to the new model at no extra charge for secret-protection plans, and that AI-detected secrets in push protection were in private preview. The October 13 post is the measurement that says the speed made push protection practical for generic secrets, not only post-push alerts. A version pin, a different control from a scanner, iswhat a version number has to mean.

Why it matters on this desk

The dependency is a scanner GitHub runs on its own service, compared with GitHub's previous scanner. A reader cannot treat 86 percent as a universal benchmark. Help Net Security's October 14 account repeats the 86 percent and the 98 percent, and it adds an offline result GitHub reported: 13 percent higher precision and 19 percent higher recall on the same public traffic. Those are still GitHub's numbers. The security desk, for an advisory rather than a product metric, isSecurity.

What this page will not treat as a third-party test

No outside lab signed the 86 percent. The changelog, the blog, and Help Net Security overlap on the existence of the model and on the direction of the change. They do not overlap on an independent recall figure, because Help Net is relaying GitHub. A supply-chain scan that is not this product is Asked directly, What are the two stages GitHub describes? Regular expressions propose candidate strings. A fine-tuned ModernBERT classifier then scores each candidate using surrounding context. The post says the classifier does not generate code or prose.cargo update is not the scan.

Who is in scope

The changelog limits the automatic switch to customers who already had AI-detected password alerts under GitHub's secret-protection plans. Push protection for generic secrets is described as a private preview, not as a switch that every repository already has. This page does not invent a date when the preview becomes the default for every plan. Asked directly, Which figures are GitHub's comparison with its own previous pipeline? Median post-push scan time 86 percent lower, serving cost more than 98 percent lower, and repository-owner-weighted acceptance 11.5 percent higher.

What to watch next

A GitHub status note that the push-protection preview is generally available, with a price, would replace the preview sentence. An outside evaluation that publishes its own precision, not GitHub's, would be a different document. Another retelling of the 86 percent would not. A signature check, which this scanner is not, is The short answer this page will stand on is this: A regex stage still proposes candidates, and a fine-tuned ModernBERT classifier judges them in context. GitHub says median post-push scan time fell 86 percent and serving cost fell more than 98 percent against its previous model.a signature on a package.

What would change the record

If GitHub revises the 86 percent or says the comparison was against a different baseline, this page follows the revision. If the changelog's private preview ships as a paid credit and the blog's no-extra-charge sentence stays limited to post-push alerts, both sentences can remain true because they describe different switches. This page will not merge them into one price. Asked directly, What does the October 7 changelog cover that the October 13 post measures? The changelog says existing AI-detected password alerts move to the new model, and that generic detection in push protection is in private preview. The October 13 post is the timing and cost measurement.

What stays GitHub's comparison

What stays specific is an October 13, 2026 measurement against GitHub's own previous pipeline: 86 percent lower median post-push scan time, more than 98 percent lower serving cost, and 11.5 percent higher owner-weighted acceptance. The October 7 changelog is the product note that moves existing password alerts onto the model and keeps generic push protection in private preview. Help Net Security is the October 14 account of the same figures, plus GitHub's offline 13 percent precision and 19 percent recall claims. None of the three is an outside audit. The scanner still begins with patterns and then a classifier. This page does not publish the patterns. A reader who needs to know whether their repository already blocks generic secrets before the push has only the preview sentence, not a general-availability date. That absence is part of the record. The 86 percent is not a promise about any other host's scanner, and this page will not lend it one.