GitHub’s model for secret detection: Finding more secrets with less noise

GitHub describes a two-stage secret scanning pipeline that uses regex candidate generation followed by a fine-tuned ModernBERT classifier that reads each candidate alongside its file path, variable names, and surrounding code. Compared with its previous LLM-based pipeline, GitHub reports 11.5% higher repository owner-weighted acceptance, 86% lower median post-push scan execution time, and more than 98% lower serving cost, with offline evaluation showing 13% higher precision and 19% higher recall. The efficiency gains made it practical to extend generic secret detection to push protection.