GitHub Cuts Secret-Scanning Time 86% With ModernBERT Classifier

GitHub's new secret-scanning classifier cut median post-push scan execution time by 86%, making it faster and cheaper to identify potential credentials while filtering likely false positives.

The system reduced serving costs by more than 98% compared with GitHub's previous remote large-language-model pipeline. It also increased repository-owner-weighted acceptance by 11.5%, a measure intended to reduce distortion from customers resolving large numbers of alerts at once.

The classifier operates in two stages. Regex filters first identify strings that may be credentials, then a fine-tuned ModernBERT model evaluates each candidate using its file path, secret type and surrounding code or text.

High-confidence findings are surfaced as alerts. Likely false positives, including placeholders, documentation examples, checksums and generated values, are filtered before they reach developers.

Offline testing on post-push scans produced 13% higher precision and 19% higher recall than the previous pipeline using the same public traffic. Precision measures how often flagged items are relevant, while recall measures how many relevant items are detected.

The lower-latency design also made it practical to extend generic secret detection to push protection, which scans code before a push is accepted. Coverage can still be affected by supported token versions, scan timeouts and push-size limits.

GitHub plans to focus future development on continuous feedback loops to improve training data. It is also exploring model architectures that combine detection and extraction in a single step.