GitHub says a ModernBERT-based secret classifier improved weighted acceptance 11.5% and cut median post-push scan time 86%.

GitHub said its new context-aware secret classifier is improving secret scanning quality while lowering execution costs, with a two-stage pipeline that combines deterministic regex candidate generation and a fine-tuned ModernBERT model for context-based classification.

In a post published on Oct. 13, 2026, GitHub described the scanner as a replacement for a previous LLM-based pipeline in the secret detection stack. The company said the new system produced an 11.5% improvement in repository owner-weighted acceptance, an 86% reduction in median post-push scan execution time, and more than 98% lower serving cost versus the remote LLM approach.

GitHub said the pipeline is designed to address a common problem in secret scanning: strings that resemble credentials but are actually harmless placeholders, documentation examples, checksums or generated values. According to the company, regex filters first generate candidate secrets with high recall, and a compact ModernBERT classifier then evaluates each candidate together with its file path, secret type and surrounding code or text. High-confidence findings are surfaced as alerts, while likely false positives are suppressed before reaching developers.

The company said offline evaluation on post-push scanning showed 13% higher precision and 19% higher recall than the prior LLM pipeline on the same public traffic. It then validated the system in a customer A/B experiment, where repository owner-weighted acceptance increased by 11.5%. GitHub said the owner-weighted measure reduces distortion from customers who bulk-resolve large numbers of alerts at once.

GitHub also said the lower-latency classifier made it practical to extend generic secret detection to push protection, which scans before a push is accepted.

Source link