GitHub previews ModernBERT to block unstructured passwords

GitHub is privately previewing a ModernBERT classifier that blocks unstructured passwords on push and could more than double secrets stopped.

GitHub and Microsoft Applied Sciences are privately previewing a ModernBERT classifier that expands Secret Protection push checks beyond recognizable token formats to unstructured secrets such as database passwords, using surrounding code. GitHub says the model scores candidate batches in under two milliseconds and could more than double the secrets that push protection blocks. From Q2 2024 to Q2 2026, screened public pushes rose 2.84 times; Help Net Security says credential-bearing pushes rose 2.59 times, while Cyber Security News says the share containing secrets showed no clear trend and that push-protection overrides fell from 6.63% to 3.93%. The outlets also differ on a roughly 30% figure: one says about 30% of newly detected secrets are blocked before they enter history, and the other says about 30% of detected secret types are stopped before history. The feature is in private preview for Enterprise Cloud and Team, with a later-October rollout reported by Help Net Security; Cyber Security News says it will consume AI credits, and both point to GitHub Enterprise Server 3.23, with Copilot security-review checks also planned.

• GitHub and Microsoft Applied Sciences built a ModernBERT classifier that uses surrounding code to flag unstructured secrets such as database passwords, beyond known token or credential formats.
• GitHub says candidate batches are scored in under two milliseconds and that the model could more than double the secrets push protection blocks.
• From Q2 2024 to Q2 2026, screened public pushes rose 2.84 times; Help Net Security says credential-bearing pushes rose 2.59 times.
• Cyber Security News says the share of pushes containing secrets showed no clear trend and that push-protection overrides fell from 6.63% to 3.93%.
• Sources differ on a roughly 30% figure: one says about 30% of newly detected secrets are blocked before history, the other that about 30% of detected secret types are stopped before history.
• The capability is in private preview for GitHub Secret Protection on Enterprise Cloud and Team; Help Net Security cites a later-October rollout, and Cyber Security News says it will consume AI credits.
• GitHub Enterprise Server 3.23 is planned to include it, and Copilot security-review checks are also planned.