A credential in a commit can leave your machine before anyone reviews the code. Check the protection on the repository that receives the push.
The new Anthropic secret types
GitHub’s October 13 release note adds anthropic_service_api_key : anthropic_user_api_key detectors. GitHub includes these types in default push protection for repositories with secret scanning enabled, including free public repositories.
The same update adds Cloudsmith detection and a partnership with Salesforce secret-scanning. Those additions have their own scope. The announcement does not state that every credential format or every repository receives the same level of protection.
Check effective settings before calling a project protected
Open the repository’s security settings and record whether secret scanning and push protection are enabled. If organization policy controls the setting, record that policy too. Keep an owner for exceptions and a reason for any allowed bypass.
Use an approved provider test value or a documented dry-run method when validating a detector. Do not create a real exposed credential to test a block. The result should establish which repository and secret type the test covered.
- Inspect repository and organization settings.
- Record the supported detector you depend on.
- Review who can bypass protection.
- Keep exceptions short and attributable.
- Store application credentials outside tracked source files.
A blocked push still deserves a local review
A rejection gives you a chance to inspect the proposed change. Look for the credential in earlier commits, generated files, and copied configuration. The commit that triggered a warning may not be the only copy.
If a real key has already been exposed, use the provider’s current revocation or rotation procedure. Removing text from the latest file alone does not disable the credential. Preserve the incident record without copying the secret into a ticket.
Our AI Scan rollout guide covers a separate code-analysis layer. The telemetry guide explains why captured tool content also needs review.
Make protection part of the project record
I would save the effective settings beside the project’s credential-storage instructions. Which repositories still rely on a developer remembering to remove a key before pushing?
Release scope checked on October 13, 2026. We have not run a detector test against a repository.
