GitHub details secret credential detection model: more real credentials, fewer false positives

GitHub’s model for secret detection: Finding more secrets with less noise

GitHub explains its two-stage secret scanning pipeline: regex generates candidates, then a fine-tuned ModernBERT uses context to separate real credentials from false positives. Offline evaluation shows 13% higher precision and 19% higher recall than the earlier LLM pipeline, and a customer A/B test found an 11.5% rise in alert acceptance rate weighted by repository owner. Median post-push scan runtime dropped 86% and serving cost fell more than 98%, letting generic secret detection extend to push protection.

Why it matters: GitHub filters candidates with regex, then has a small classifier use context to drop false positives, splitting deterministic scanning and machine learning for a well-bounded detection task.