GitHub secret scanner update and tools roundup

GitHub reports a faster, cheaper ModernBERT secret classifier, while a separate editorial ranks ten detection tools.

GitHub’s 13 October 2026 security post describes a two-stage secret scanner that generates candidates with regexes and scores them with a fine-tuned ModernBERT classifier. Compared with its earlier remote LLM pipeline, GitHub reports an 11.5% increase in owner-weighted alert acceptance, an 86% reduction in median post-push scan time, and more than a 98% drop in serving cost, which it says made generic secret detection practical inside push protection. Two days later, GBHackers published a 2026 comparison of ten secrets-detection products, separating dedicated platforms, verification engines, native controls, and cloud or SaaS scanners. That roundup ranks GitGuardian for platform detection, honeytokens, and non-human identity governance, highlights TruffleHog for live-secret verification, and treats GitHub Secret Scanning plus Gitleaks as the free floor, with Nightfall, Wiz, Snyk, Aikido, Check Point Spectral, and 1Password covering collaboration, cloud context, and vault-adjacent workflows. The sources do not contradict each other: GitHub supplies product metrics for its own classifier, while GBHackers offers an editorial ranking and says it performed no lab testing and found no new vulnerability.

• On 2026-10-13, GitHub described a two-stage secret scanner: regex candidate generation followed by a fine-tuned ModernBERT classifier that scores each candidate with context.
• Versus its previous remote LLM pipeline, GitHub reported an 11.5% rise in owner-weighted alert acceptance, an 86% cut in median post-push scan time, and more than 98% lower serving cost.
• GitHub said the speed gain made generic secret detection practical in push protection, so findings can be returned before a push is accepted.
• On 2026-10-15, GBHackers published an editorial comparison of ten secrets-detection tools and named no new vulnerability; it said ratings were research-based and claimed no lab testing.
• GBHackers ranked GitGuardian for dedicated detection, honeytokens, and non-human identity governance, and cited TruffleHog for verifying which exposed secrets still work.
• GitHub Secret Scanning with push protection and Gitleaks were described as the free baseline; Nightfall, Wiz, Snyk, Aikido, Check Point Spectral, and 1Password were placed in SaaS, cloud, and vault-adjacent workflows.