GitHub's secret detection model: finding more secrets with less noise

GitHub trained a fine-tuned ModernBERT classifier to replace its previous LLM-based pipeline for generic secret detection, improving owner-weighted alert precision by 11.5% and cutting median post-push scan execution time by 86%. The two-stage pipeline uses regex candidate generation followed by context-aware classification, which also lowered serving cost by more than 98% versus remote LLM calls. The efficiency gain made it practical to extend generic secret detection to push protection, returning results before changes are pushed.