GitHub’s model for secret detection: Finding more secrets with less noise
GitHub’s context-aware secret classifier improves detection quality, raises weighted acceptance by 11.5%, and reduces median scan execution time by 86%. The post GitHub’s model for secret detection: Finding more secrets with less noise appeared first on The GitHub Blog.
GitHub introduced a context-aware secret detection model that improves accuracy, reduces false positives, and lowers computational costs through a hybrid pipeline combining regex and a fine-tuned ModernBERT classifier.
What happened
GitHub developed a new secret scanning system that uses a context-aware classifier to distinguish real credentials from false positives. The system combines regex-based candidate generation with a fine-tuned ModernBERT model, reducing scan times and costs while improving detection accuracy.
Why it matters
For developers and security teams, this reduces distracting false positives and accelerates feedback in critical workflows like commits and pull requests. The efficiency gains enable broader secret detection without compromising security.
- Hybrid systems combining regex and ML achieve optimal balance between speed and accuracy
- Context-aware models significantly reduce false positives in secret detection
- Efficient ML models (like ModernBERT) enable cost-effective security solutions
- Continuous feedback loops improve model quality over time
- Model size and efficiency matter as much as accuracy in production systems
The bigger picture
The system enables faster, more accurate secret detection at scale, reducing operational costs for organizations while maintaining high security standards. The approach demonstrates the effectiveness of compact ML models in security workflows.
GitHub's new secret detection system demonstrates how context-aware machine learning can enhance security workflows, achieving better accuracy, speed, and cost efficiency through a hybrid approach.
Technical details
- ModernBERT: fine-tuned transformer model for code context analysis
- Regex patterns for high-recall candidate generation
- 8-bit quantized ONNX model for efficient inference
- Context features: file path, variable names, surrounding code/text
- Hybrid system: deterministic regex + machine learning classification
FAQ
How does the new system improve upon previous secret detection methods?
It uses a context-aware classifier (ModernBERT) to reduce false positives while maintaining high recall, compared to previous LLM-based approaches.
What are the key technical innovations?
A two-stage pipeline with regex for candidate generation and a compact, quantized transformer model for context-aware classification.
How does the system handle false positives?
By analyzing context (file paths, surrounding code, variable names) to distinguish real secrets from lookalikes like placeholders or test fixtures.
What are the performance benefits?
86% faster scan times, 98% lower serving costs, and 11.5% higher user acceptance of detected findings.
What future improvements are planned?
Single-step secret detection models and continuous improvement through production feedback loops.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by GitHub Blog AI on Oct 13, 2026.
Comments
Sign in to join the discussion.