GitHub upgrades secret detection: existing alerts stay included, new checks will use credits
GitHub has upgraded existing AI-detected secret alerts with a purpose-built model and plans to extend detection to push protection and Copilot security reviews. Existing alerts remain included at no extra charge; the additional checks have separate availability and credit-billing conditions.
GitHub says the fine-tuned model reads surrounding code to identify likely credentials, including passwords without a fixed token format. It classifies potential secrets rather than generating code or prose. Existing AI-detected Password alert customers have been upgraded automatically; those scans remain included in GitHub Secret Protection (GHSP) and GitHub Advanced Security (GHAS) at no additional charge. GitHub also plans to bring these alerts to GitHub Enterprise Server (GHES) 3.23 in public preview, included with existing GHSP/GHAS purchases.
AI secret detection in push protection was in private preview at the time of the announcement. It checks for unstructured credentials when code is pushed, giving developers a chance to remove secrets before they enter repository history. GitHub specifies GitHub Enterprise Cloud or GitHub Teams with GHSP or GHAS as the eligibility requirements. An administrator must enable the feature under organization or enterprise policies.
The new push-protection checks will consume GitHub AI Credits, potentially even when they do not block a push. Usage normally belongs to the repository-owning organization rather than an individual user’s allocation. User-namespace repositories for enterprise-managed users (EMUs) are an exception: usage is attributed to the pusher and counts against their allocated credits. The announcement ties billing to opting into public preview and enabling the feature; that condition does not mean public preview is already available.
The existing /security-review command in Copilot CLI and the Copilot app performs a read-only security review of active changes, returning prioritized findings and suggested fixes under existing Copilot policies and billing. GitHub plans to add secret-classifier checks alongside this large-language-model review, with private preview coming soon. The new checks will not require a GHSP or GHAS license, but will consume AI Credits in addition to the review’s existing usage, billed to the account for the active Copilot plan.
The new Copilot checks will be off by default, and running /security-review will not enable them. Users must opt in where their plan and policies allow. Here too, the announcement ties billing to opting into public preview and enabling the feature. GitHub says credit consumption for these additional checks will begin in the weeks following the announcement, without specifying a unit price or effective date.
Customers already using AI push protection in private preview will also consume credits if they continue after the billing change takes effect. Administrators can control the new capabilities through policy and set budgets, but budget alerts alone do not stop usage. A spending cap requires enabling “Stop usage when budget limit is reached” where available. Existing AI-detected secret alert scanning remains included at no additional charge.