GitHub's AI classifier for secret scanning cuts false alerts and scan time

Summary

GitHub trained a small ModernBERT classifier to work after regex matching in secret scanning. It reads each candidate with its file path and surrounding code to decide whether it is a real secret. GitHub reports higher precision and recall, faster scans and much lower serving cost than its earlier LLM-based pipeline.

What changed

• Regex finds candidate secrets, then a fine-tuned ModernBERT model checks each one in context.
• Median post-push scan time is 86% lower than the previous LLM-based pipeline.
• Repository owner-weighted acceptance of alerts rose 11.5% in a customer A/B test.
• The faster model made generic secret detection practical for push protection.
• GitHub reports more than 98% lower serving cost than the LLM-based pipeline.

Availability

“That is why we shipped a new scanner using a two-stage pipeline:”

Sources

1. GitHub — GitHub’s model for secret detection: Finding more secrets with less noisePublished 13 Oct 2026 · Checked 15 Oct 2026