GitHub’s model for secret detection: Finding more secrets with less noise

Smarter secret scanning, at a fraction of the cost

11.5%### higher acceptance

Owner-weighted alert precision

86%### lower median scan execution time

Post-push scanning

98%### lower serving cost

Compact model vs. remote LLM calls

JavaScript draws the arrows connecting these cards. OUR PIPELINE VS. THE PREVIOUS LLM PIPELINE

Smarter secret scanning, at a fraction of the cost

11.5% higher acceptance

Owner-weighted alert precision

86% lower median scan execution time

Post-push scanning

98% lower serving cost

Compact model vs. remote LLM calls

Secret scanning works best when developers are confident in the findings. Catch too little, and real credentials can remain in a repository. Alert too often, and developers may spend time investigating strings that aren’t secrets.