GitHub’s model for secret detection: Finding more secrets with less noise
GitHub's ModernBERT secret classifier raised alert acceptance 11.5% and cut median scan time by 86%.
GitHub described a two-stage secret scanner that uses regex candidate generation and a fine-tuned ModernBERT classifier to separate real credentials from lookalikes. Compared with its previous LLM pipeline, GitHub reports an 11.5% rise in owner-weighted alert acceptance, an 86% reduction in median post-push scan time, and more than 98% lower serving cost. The efficiency gain let GitHub extend generic secret detection to push protection so findings can be returned before a push is accepted.
48