GitHub Announces Fine-Tuned Secret Detection Model, With AI Push Protection in Private Preview and Opt-In Checks Billed in AI Credits
GitHub's October 7 changelog says a fine-tuned model now powers AI-detected Password alerts at no extra charge, while push protection and security-review checks will consume AI Credits.
Overview
GitHub said on October 7, 2026 that it is extending a fine-tuned secret-detection model across secret scanning alerts, push protection and Copilot security reviews, according to the GitHub Changelog. The post describes the model as one that “reads surrounding code to identify likely credentials, including passwords without a recognizable token format, without generating code or prose.” Existing alerts move to the new model at no extra charge, while the new opt-in checks are planned to consume GitHub AI Credits.
The account below rests on GitHub’s own changelog and documentation. The Machine Herald did not find independent coverage or testing of the model as of October 10, 2026.
What We Know
What is available now. The changelog says customers with AI-detected Password alerts “have automatically been upgraded to the new model.” It adds that, starting on the day of the post, existing AI-detected secret alert scans switch to the new model “at no additional charge for GHSP and GHAS customers,” the abbreviations the post uses for GitHub Secret Protection and GitHub Advanced Security, per the GitHub Changelog.
Push protection. According to the changelog, AI-detected secrets in push protection “is available in private preview.” The post says the check looks for unstructured credentials at push time, “giving you a chance to remove a secret before it enters repository history.” It says the feature will be available to customers on GitHub Enterprise Cloud or GitHub Teams with a purchase of GHSP or GHAS, and that an administrator must enable it, subject to organization or enterprise policies, per the GitHub Changelog.
Copilot security review. The changelog says AI-based secret scanning with the /security-review command for the Copilot CLI and Copilot app is “available soon in private preview.” GitHub’s documentation says the /security-review slash command is currently in public preview, reviews current workstream changes for high-confidence vulnerabilities, and returns prioritized findings with severity and confidence scores. The documentation does not mention the secret checks; the changelog says they will be added alongside the existing LLM-based review. The changelog states that a GHSP or GHAS license is not needed for these checks, and that individual Copilot plans (Pro, Pro+, Max, Free and Student) are eligible subject to access controls and credit consumption.
Billing. The changelog says the new opt-in checks for push protection and the security review command “will consume GitHub AI Credits,” and that AI Credit usage for them “will be introduced in the coming weeks.” For push protection, it says usage will be billed to the organization that owns the repository, that “A check can consume credits even if it doesn’t block a push,” and that usage will be listed under the Secret Protection AI Credits SKU. The post says billing begins once an organization opts into the public preview and enables the feature. For the security-review checks, it says they will be off by default and that running /security-review “won’t enable them.” All of this is from the GitHub Changelog.
Controls. The changelog says administrators will be able to disable the new capabilities by policy and set budgets. To set a dedicated budget, it directs administrators to Billing and licensing, then Budgets and alerts, then a SKU-level budget with Advanced Security as the product and Secret Protection AI Credits as the SKU. It cautions that “Budget alerts alone don’t stop usage” and that a spending cap requires the “Stop usage when budget limit is reached” setting where available. The post also says agents “shouldn’t enable credit-consuming features or change policies or budgets without explicit authorization.”
GitHub Enterprise Server. According to the changelog, the model will bring AI-detected alerts to GHES 3.23 in public preview, included with an enterprise’s existing GHSP and GHAS purchase. It states that AI push protection and the Copilot security review command are not part of that Server release.
What We Don’t Know
The changelog does not publish detection accuracy, false-positive rates or benchmark results for the model, and it does not name the underlying model or give a general-availability date. It does not state a per-check AI Credit price; it says only that credit usage will be introduced in the coming weeks. It also does not give a date for the /security-review secret checks beyond “available soon in private preview.” No independent evaluation of the model had been located as of October 10, 2026.
Context
The announcement follows other recent secret-scanning activity. A separate GitHub Changelog entry dated October 5, 2026 says secret scanning now detects new secret types from Lovable Labs, Pydantic Services Inc., and Supabase. The Machine Herald previously reported on Truffle Security’s research, which said 51.8 percent of live credentials in its corpus were connection strings, Google API keys or private keys, none of which are blocked by default. The October 7 changelog does not mention the Truffle research, and it says only that the push protection check looks for “unstructured credentials,” so whether the two relate is not established by either source.