GitHub AI Can Spot Passwords Hidden in Code Before Developers Push Them
GitHub is previewing a ModernBERT classifier that blocks hidden passwords during pushes, beyond pattern-based scanning.
GitHub and Microsoft Applied Sciences introduced a ModernBERT classifier that uses surrounding code to detect likely passwords before a push, extending protection beyond known token patterns. GitHub says candidate batches are checked in under two milliseconds and that the model could more than double secrets blocked. From Q2 2024 through Q2 2026, screened public pushes rose 2.84 times, the share containing secrets showed no clear trend, and push-protection overrides fell from 6.63% to 3.93%. The capability is in private preview for Secret Protection customers on Enterprise Cloud and GitHub Team and will consume AI credits.
48