GitHub adds default push protection for Anthropic key types in enabled repositories
GitHub announced on October 13 that secret scanning now detects additional credential types from Anthropic, Salesforce and Cloudsmith. Its changelog also adds two Anthropic types to push protection by default: service API keys and user API keys. This is a repository security update, not a finding that any particular customer account has been compromised.
The default blocking statement applies to repositories with secret scanning enabled, including free public repositories. GitHub says commits containing the newly covered Anthropic secrets will be automatically blocked there. Buyers should check whether their relevant repositories have secret scanning and push protection configured rather than assuming every private repository receives the same controls without setup.
The new detectors recognize Anthropic service and user API key types and Cloudsmith API keys. Salesforce becomes a secret-scanning partner for its Marketing Cloud API OAuth2 token type. Detection coverage and default push protection are distinct: the announcement lists the Anthropic types in the expanded default protection table, not every newly detected credential type.
GitHub explains that partner secrets found in public repositories are forwarded to the relevant issuer so the issuer can revoke or rotate them. User secrets produce scanning alerts in public or private repositories. That statement does not guarantee immediate revocation of every Anthropic credential, and the announcement should not be rewritten as a promise that exposed keys are always disabled automatically.
For teams building Claude applications or agents, the practical change is another check against committing recognized credentials into code history. An alert or blocked push still needs a team response under its security process. This announcement does not establish that secrets stored elsewhere, disguised credentials or every possible leak path are covered by these particular repository detectors.
The release gives no new standalone dollar price or complete entitlement comparison for this change. Repository administrators should verify the controls and plan access relevant to their organization using GitHub documentation. Default detection is a useful safeguard within its stated scope, not independent certification of a codebase or a guarantee against credential misuse.