GitHub separates included secret alerts from planned credit-billed checks
GitHub's October 7 announcement distinguishes an included upgrade to AI-detected password alerts from new opt-in checks planned to consume GitHub AI Credits. Its purpose-built model reads surrounding code to identify likely credentials, including passwords without a recognizable token format, without generating code or prose.
Customers using AI-detected Password alerts were automatically upgraded to the model. Those alert scans remain included in GitHub Secret Protection and GitHub Advanced Security at no additional charge. GitHub also plans AI-detected alerts in GitHub Enterprise Server 3.23 public preview under existing GHSP or GHAS coverage.
AI-detected secrets in push protection are in private preview. The announcement describes planned credit usage before broader availability: billing starts when an organization opts into the public preview and enables the feature. A check can consume credits even when it does not block a push.
Push-protection credit usage is generally billed to the organization owning the repository under the Secret Protection AI Credits SKU. GitHub identifies an exception for enterprise-managed user namespace repositories, where usage is attributed to the pusher and their allocated credits. Eligibility still requires the applicable platform and GHSP or GHAS coverage.
GitHub also says secret-classifier checks for Copilot CLI and Copilot App security reviews are coming in private preview. They will be off by default and consume credits in addition to existing review usage once enabled. These checks do not require a separate GHSP or GHAS license; that does not make their usage free.
Administrators should distinguish included alert scanning, private-preview access and future opt-in billing. GitHub says budget alerts alone do not stop usage; a stop-usage setting is needed where available for a spending cap. The October 7 notice is not evidence that every announced feature is generally available or that running a review automatically enables the new checks.