GitHub wants secret protection to keep pace with AI code
GitHub is extending push protection to harder-to-spot credentials with a fast classifier, as software output grows.
Published by Histic on 13 October 2026. In a 7 October post, GitHub argues that the volume of software creation is rising faster than manual secret-remediation work can scale. It introduced a classifier designed to recognize unstructured credentials before they are pushed.
The new protection
GitHub says its model examines candidate secrets in code context and can process a batch in under two milliseconds. The company says adding it to push protection could more than double the number of secrets it can prevent. The push-protection feature was in private preview at the time of the post, while other detection surfaces were receiving updates.
The data behind the concern
GitHub reports that public pushes and credential-bearing pushes both rose substantially over nine quarters, without a detectable increase in the share of pushes containing secrets. Its reading is that developers are being outpaced by volume, rather than simply becoming less careful. A leaked credential is costly to investigate and revoke once it is in public history.
A practical response
Prevention should sit close to the developer's workflow: local checks, push blocking, scoped credentials, and quick rotation after exposure. Teams should still treat alerts as evidence to investigate, because any detector can produce false positives or miss a novel pattern. The point is to reduce the number of leaks that demand a manual response.