GitHub swaps LLM-based secret scanner for a lightweight ModernBERT classifier
In short: GitHub replaced its LLM-based pipeline for detecting generic secrets (like passwords and API keys) with a fine-tuned ModernBERT classifier combined with regex candidate generation. The new two-stage system improved detection accuracy while cutting scan time and serving costs dramatically, and it's now fast enough to run during push protection, not just after code is committed.
This summary was generated automatically by AI from GitHub's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1Two-stage pipeline: regex finds candidate secrets, then a fine-tuned ModernBERT classifier judges context
- 213% higher precision and 19% higher recall in offline evaluation vs the previous LLM pipeline
- 311.5% higher owner-weighted acceptance in a customer A/B test, meaning fewer false positives developers had to dismiss
- 486% lower median post-push scan execution time, making real-time push protection practical
- 5More than 98% lower serving cost compared with remote LLM calls
- 6Model exported to ONNX with 8-bit quantization for fast inference
| Parameter | Before | Now |
|---|---|---|
| Architecture | Remote LLM-based classification pipeline | Two-stage pipeline: regex candidate generation + fine-tuned ModernBERT classifier (ONNX, 8-bit quantized) |
| Precision | Baseline (previous LLM pipeline) | 13% higher (offline evaluation) |
| Recall | Baseline (previous LLM pipeline) | 19% higher (offline evaluation) |
| Owner-weighted acceptance | Baseline (previous LLM pipeline) | 11.5% higher (online A/B) |
| Median post-push scan execution time | Baseline (previous LLM pipeline) | 86% lower |
| Serving cost | Baseline (previous LLM pipeline) | More than 98% lower |
Why it matters
Faster, cheaper, more accurate secret detection means fewer disruptive false alerts for developers and security teams, and the ability to catch real credentials before they are even pushed to a repository — directly reducing the risk of leaked API keys, database passwords and other secrets reaching production code.
What it means for AI agents and contact centers
If source code for voice AI agents, CRM integrations or SIP/Asterisk configurations lives in GitHub repositories, this kind of secret-scanning improvement reduces the chance that leaked credentials (API keys for STT/TTS providers, CRM tokens, telephony secrets) slip through unnoticed, while cutting the noise of false-positive alerts that security teams would otherwise have to triage.
🧪 Worth Testing
Evaluating GitHub's updated secret scanning (push protection and post-push) against your own repositories can reveal whether it catches real credential leaks in voice AI, telephony or CRM integration code with fewer false positives than before.
Sources
- GitHubOfficialPrimary sourceOriginal article →„GitHub’s model for secret detection: Finding more secrets with less noise“13 Oct 2026, 20:56
- Published by source
- 13 Oct 2026, 20:56
- Found by our system
- 13 Oct 2026, 21:11
- Summary generated
- 13 Oct 2026, 21:12
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy