GitHub Deploys ModernBERT Classifier to Cut Secret Detection Costs and False Positives
GitHub has replaced its large language model-based secret detection pipeline with a purpose-built ModernBERT classifier, reducing median post-push scan execution time by 86% and cutting inference costs by over 98%. The update extends context-aware generic secret detection to push protection, enabling the platform to block credentials before they enter a repository rather than just alerting after a commit.
How GitHub’s Two-Stage Secret Scanning Pipeline Works
Detecting generic secrets is difficult because high-entropy strings often overlap with build identifiers, checksums, and asset hashes. CybersecurityNews observed that "a thousand regex hits hide the ten live credentials that matter".
To solve this, GitHub designed a two-stage pipeline. The first stage uses regex filters to cast a wide net and generate candidates with high recall. The second stage passes these candidates to a fine-tuned ModernBERT classifier.
The classifier evaluates the candidate alongside its file path, variable names, and surrounding code to distinguish real secrets from placeholders or test fixtures. This context-aware approach yielded an 11.5% user acceptance improvement by filtering out false positives before they reach developers.
Why GitHub Replaced LLMs with a Fine-Tuned ModernBERT Model
The transition from an LLM-based pipeline to a specialized, smaller model was driven by the strict latency and cost requirements of real-time push protection. LLMs are computationally expensive and too slow to evaluate every commit at GitHub’s scale without causing friction in the developer workflow.
By utilizing ModernBERT, GitHub achieved more than 98% cost savings compared to its previous LLM architecture. This efficiency makes it practical to run generic secret detection synchronously during a push, rather than relying solely on asynchronous post-push scanning.
According to Welcome.AI, this shift aligns with GitHub’s strategy to integrate advanced security features into its subscription tiers, specifically requiring GitHub Secret Protection (GHSP) or GitHub Advanced Security (GHAS) for AI push protection.
How the Update Shifts the Secrets Detection Landscape
GitHub’s native scanning currently ranks third in the broader secrets detection market, behind GitGuardian and Truffle Security, according to CybersecurityNews. While third-party tools often excel in live-verification and cross-platform sprawl, GitHub’s advantage lies in its native integration at the point of commit.
As SentinelOne notes, secret sprawl occurs when credentials proliferate uncontrolled across repositories, issues, pull requests, and wikis. By catching generic secrets at the push stage, GitHub shifts the remediation burden from security teams reviewing backlogs to developers fixing code in real time.
"Secret scanning works best when developers are confident in the findings." — GitHub Engineering
What Developers Need to Know About GitHub’s New AI Credits
The rollout introduces specific billing mechanics for the new capabilities. According to daily.dev, “AI-detected secret alerts are automatically upgraded” to the new model at no extra charge for existing GHSP and GHAS customers.
However, new opt-in checks for push protection and the Copilot /security-review command will consume AI Credits once billing begins. The model is also expanding to GitHub Enterprise Server 3.23 in public preview, giving administrators the ability to set budgets and disable capabilities by policy while specifically targeting passwords that lack recognizable token formats.
