GitHub push protection now blocks Anthropic API keys by default, including on free public repositories
Secret scanning adds detectors for Anthropic, Cloudsmith and Salesforce, and puts the two Anthropic key types into push protection by default.
// Key points
- New detectors: anthropic_service_api_key, anthropic_user_api_key and cloudsmith_api_key; Salesforce joins as a secret scanning partner for Marketing Cloud OAuth2 tokens.
- Repositories with secret scanning enabled, including free public ones, will have commits containing the two Anthropic key types blocked automatically.
- In a companion post the same day, GitHub said its fine-tuned ModernBERT secret classifier cut median post-push scan time by 86% and serving cost by more than 98% versus its previous LLM pipeline.
Builder's takeThis closes one of the leaks the 10-13 self-replication research pointed to: stolen API keys paying for someone else’s inference. A blocked push is still a key that sat in a working tree, so I’d keep model keys in a secret manager and rotate any that ever touched a repo. The classifier numbers are also a useful pattern: a small fine-tuned model replaced an LLM call at under 2% of the cost.