GitHub expands its secret scanning partner program with 28 new detectors in March 2026, featuring AI-powered validity checks and push protection.
What the Expansion Covers
GitHub’s secret scanning partner program is adding 28 new detectors in March 2026. Partner detectors cover credentials issued by third-party services—API keys, tokens, and similar secrets that GitHub can match with patterns supplied by those providers. When a match lands in a repository, GitHub can alert the repository owner and, when the partner supports it, notify the issuer so the secret can be revoked or rotated.
The same release emphasizes two operational features: AI-powered validity checks and push protection. Validity checks try to determine whether a matched string is still live rather than a expired, revoked, or format-similar false positive. Push protection blocks commits that contain known secret patterns before they reach the default branch, which is the point where exposure becomes hardest to undo.
Why Detector Coverage and Validity Matter Together
Pattern matching alone is noisy. Many secrets look like random strings; some formats overlap with test fixtures, documentation examples, or truncated values. Without a validity step, teams either ignore alerts or drown in tickets. AI-assisted verification is meant to reduce that noise by ranking or classifying matches so responders spend time on credentials that still grant access.
Broader detector coverage helps only if the alert path is trustworthy. Each new partner pattern increases the chance of catching a real leak, but it also multiplies opportunities for false matches. Pairing more detectors with validity checks is the practical tradeoff: expand what you can find, then filter what you must act on.
How Push Protection Fits the Workflow
Push protection works earlier than post-commit scanning. Instead of discovering a secret after it is already in history, the client or server rejects the push when a known pattern is present. That shortens the window in which a leaked key can be scraped from a public fork, a CI log, or a cached clone.
- Enable secret scanning and push protection on every repository that holds application or infrastructure code, not only public ones.
- Treat partner-detector alerts as rotation tickets: revoke first, then investigate how the secret entered the tree.
- Keep test doubles and docs free of real-looking credentials so validity checks and human review stay focused on live risk.
- Wire alerts into the same channel you use for production incidents so secrets do not sit in a separate, ignored queue.
Practical Steps for Teams
Inventory which third-party services your stack actually uses, then confirm those issuers appear among GitHub’s partner detectors. Gaps still need org-level rules: custom patterns for internal tokens, pre-commit hooks for formats GitHub does not cover, and short-lived credentials so a single leak has a hard expiry.
When an alert fires, assume the secret is compromised until validity checks or the issuer say otherwise. Rotate, invalidate sessions, and search history for prior exposure—not only the commit that triggered the scan. Push protection reduces future mistakes; validity-aware partner scanning shortens response time on the ones that still slip through.