Secret protection must scale with software

What it is

A GitHub essay (Erin Havens, Secret Protection PM) arguing that secret-leak prevention must scale with AI-accelerated code volume, and introducing the mechanics and rollout detail behind the ModernBERT classifier for push protection.

How it works

The classifier evaluates candidate secrets using surrounding code and context rather than pattern-matching alone, which matters because unstructured secrets (e.g., an internal database password) have no recognizable prefix or format to detect. It runs without generating code or prose — it's a pure classifier, not an LLM pipeline — which the essay credits for both its precision and its sub-2ms batch latency. The piece frames the design tradeoff as a "four-body problem": precision, latency, throughput, and cost are coupled constraints, since a check too slow or expensive to run on every push can't scale, and a check with too many false positives erodes developer trust in future blocks.

Preconditions / Affected

Separately from the ModernBERT rollout, GitHub's existing partner-based detection covers 150+ technical partners (OpenAI, Google Cloud, Slack, Hugging Face, SendGrid, etc.) under a secret-scanning partnership program; for these issuer-bound credentials, partners can revoke tokens immediately on notification without waiting on developer action. Currently, push protection (pattern-based, pre-ModernBERT) stops about 30% of newly detected secret types before they enter repo history — the other 70% are only caught post-push, after the credential is already exposed.

What to do

• The ModernBERT feature is in private preview and rolls out later this month to orgs with GitHub Secret Protection (Enterprise Cloud and GitHub Teams); it consumes AI credits.
• It's also exposed as a /security-review command in Copilot CLI and Copilot App, usable even without a Secret Protection plan; AI credit usage from this is attributed to GitHub Secret Protection in AI usage insights.
• GitHub states the model could more than double the share of secrets it can prevent before they're pushed.

Caveats

The essay's own data shows push-path override rates falling (6.63%→3.93%) and no detectable trend in per-push leak prevalence despite 2.59x growth in credentialed pushes — used to argue developers aren't getting more careless, but this is GitHub's self-reported telemetry, not independently audited. The ModernBERT performance claims (precision, "more than double" prevention, sub-2ms latency) are vendor-stated ahead of general availability; no third-party benchmark is cited.