GitHub details ModernBERT secret classifier, reporting faster scans without an on-device claim
GitHub's technical account of its secret classifier, published October 13 and updated October 14, 2026, describes a compact ModernBERT model for separating real credentials from lookalikes. The company reports an 86 percent reduction in median post-push scan execution time compared with its previous LLM-based pipeline. That is GitHub's measured pipeline result, not a benchmark for all secret scanners.
The scanner combines two stages. Regular expressions generate candidate strings with broad coverage, then a fine-tuned ModernBERT classifier evaluates each candidate alongside context such as file path, variable names and nearby code. The model complements deterministic scanning rather than replacing every detection rule.
GitHub says the model runs on its inference infrastructure and is exported to ONNX with 8-bit quantization. This source does not establish that the classifier runs locally on a developer's laptop. Describing the change as on-device scanning would confuse a compact model with a verified deployment location.
In an offline comparison on the same public traffic, GitHub reports 13 percent higher precision and 19 percent higher recall for post-push scanning. A separate customer A/B experiment reports an 11.5 percent increase in repository owner-weighted acceptance. The weighting reduces the influence of customers who resolve many alerts at once, so these results should not be presented as one interchangeable accuracy score.
The company also reports serving costs more than 98 percent below the earlier remote-LLM pipeline. Faster classification made it practical to extend generic secret detection to push protection, which checks changes before a push is accepted. The 86 percent result specifically measures median post-push execution time, not a universal latency guarantee for every push.
GitHub describes the classifier as making a best effort to distinguish likely secrets from harmless strings such as examples, test fixtures and checksums. The results do not prove that all credentials will be caught or that an already exposed credential is safe to keep. Teams still need to investigate findings and handle credential exposure within their own security process.