GitHub reads surrounding code to spot exposed passwords
GitHub has moved existing AI password alerts to a dedicated model that reads surrounding code to identify likely credentials. It can detect passwords without a familiar provider-specific pattern. Additional checks at code submission and in Copilot security reviews are being introduced through private previews, with separate credit use. Administrators control those optional features; existing alert scanning retains its current security-plan coverage.
Artificial Intelligence··Midday
Passwords can be found without a familiar pattern
GitHub has introduced a dedicated AI classifier for secret detection. It examines the code around a suspected credential and can identify passwords that lack a recognizable provider-specific format. The model adds context-based detection to the platform’s existing secret-protection tools.[1], [2]
Customers already receiving AI password alerts have been moved to the new model automatically. Those alerts remain part of GitHub Secret Protection and GitHub Advanced Security without an additional fee. The classifier labels likely secrets; it produces neither replacement code nor explanatory text.[1]
Checks before code submission remain in preview
AI secret checks at push time are in private preview. A further private preview is planned for Copilot’s security-review command in its command-line tool and app. Administrators must enable the optional checks under the applicable policies. They are planned to consume GitHub AI Credits, and a check can use credits even when it does not stop a submission.[1]
Administrators control access and spending
Copilot security review reads active changes and returns prioritized findings without editing them. The extra secret checks are off by default; starting an ordinary review does not activate them. Enterprise policies can restrict the capabilities and set budgets. A budget warning alone does not halt spending: the separate stop-at-limit option must be configured where available.[1]
