GitHub swaps LLM-based secret scanner for a lightweight ModernBERT classifier
GitHub replaced its LLM-based pipeline for detecting generic secrets (like passwords and API keys) with a fine-tuned ModernBERT classifier combined with regex candidate generation. The new two-stage system improved detection accuracy while cutting scan time and serving costs dramatically, and it's now fast enough to run during push protection, not just after code is committed.