OUR PIPELINE VS. THE PREVIOUS LLM PIPELINE

Smarter secret scanning, at a fraction of the cost

Owner-weighted alert precision

86%

lower median scan execution time

Post-push scanning

Compact model vs. remote LLM calls

Secret scanning works best when developers are confident in the findings. Catch too little, and real credentials can remain in a repository. Alert too often, and developers may spend time investigating strings that aren’t secrets.

Generic secrets make that balance especially difficult. The same string could be a real credential or a documentation placeholder, so detecting it requires understanding the surrounding code and text.

To address this challenge, we trained a secret classifier specifically for GitHub’s product needs: distinguishing real credentials from lookalikes while meeting the speed and efficiency requirements of scanning at scale.

In our companion post, Secret protection must scale with software , we explained why secret protection must keep pace with AI-accelerated…