GitHub credential detection: ModernBERT cuts costs 98% and boosts acceptance
GitHub replaces its large language model pipeline with a faster context-aware classifier to reduce noise and accelerate credential detection.
Key points
- Median post-push scan execution time fell by 86 per cent compared with the previous system.
- Weighted user acceptance of findings rose by 11.5 per cent due to fewer false positives.
- The new pipeline costs more than 98 per cent less to operate than the former LLM approach.
GitHub has deployed a new context-aware classifier for secret detection that significantly reduces processing time and improves accuracy. The update replaces a previous large language model pipeline with a fine-tuned ModernBERT model, allowing the platform to distinguish real credentials from lookalikes more effectively. This change enables faster feedback for developers during code pushes.
Root cause
Generic secrets often lack distinctive structural markers, making them difficult to separate from non-sensitive strings such as build identifiers or documentation placeholders. The previous system struggled with these ambiguous cases, leading to high volumes of false positives. To address this, GitHub trained a classifier specifically designed to interpret surrounding code context, including file paths and variable names, rather than relying solely on pattern matching.
Attack path
The scanning process uses a two-stage pipeline to identify potential credentials. First, regex filters cast a wide net to catch broad families of credential-like patterns quickly. Second, the ModernBERT classifier evaluates each candidate alongside its surrounding text. This model estimates the likelihood of a string being a real secret, filtering out placeholders and test fixtures before alerts reach developers.
Affected versions
- The update applies to GitHub’s secret scanning infrastructure across all repositories.
- It affects both push protection and post-push scanning workflows.
- No specific software version numbers are cited for the scanner component.
Mitigation
- Review existing secret scanning alerts to identify potential false positives.
- Ensure push protection is enabled to catch secrets before commits are accepted.
- Monitor post-push alerts for any changes in detection behaviour after the update.
Why it matters
Security teams often face a trade-off between catching every potential secret and overwhelming developers with false alarms. When scanners generate too much noise, engineers may ignore alerts, leaving real vulnerabilities exposed. Context-aware detection helps resolve this by using surrounding code to validate findings. Teams should evaluate whether their own scanning tools use similar contextual signals to reduce fatigue and improve remediation rates.
What to do and how to stay safe: GitHub
- Verify that your organisation’s code repositories have secret scanning enabled.
- Check if push protection is active to block credentials before they are committed.
- Review recent alerts to ensure they align with actual sensitive data.
- Once the vendor provides an update, test the new scanner in a non-production environment.
Step-by-step guide: Password Policies Examples That Reduce Password Fatigue
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much faster is the new secret scanner?
The median post-push scan execution time is 86 per cent faster than the previous LLM-based pipeline.
Does the new system reduce false positives?
Yes, weighted user acceptance improved by 11.5 per cent, indicating fewer false positives.
What model powers the new classifier?
A fine-tuned ModernBERT classifier evaluates candidates and their surrounding context.
