The News, Explained
GitHub expanded secret scanning, its system for finding credentials accidentally placed in repositories, on October 13, 2026. The new detectors cover Anthropic service and user API keys, Cloudsmith API keys, and Salesforce Marketing Cloud API OAuth2 tokens. An API key or OAuth2 token is a string that proves an application or automation has permission to call an external service. Storing one with source code can expose that authority to people who can read the repository. Source
The update combines three different actions: detection, reporting to an issuer, and blocking a commit. Detection identifies a supported credential pattern in code. GitHub added detectors for Anthropic’s anthropic_service_api_key and anthropic_user_api_key, Cloudsmith’s cloudsmith_api_key, and Salesforce’s salesforce_marketing_cloud_api_oauth2_token. Source
Salesforce also joined GitHub’s secret scanning partner program. When a supported partner secret is found in a public repository, GitHub forwards it to the company that issued it so the provider can revoke or rotate the credential before abuse. GitHub describes a reporting path that gives the issuer a chance to act. Discovery in a public repository does not establish one universal moment when every token is automatically revoked. Source
GitHub handles partner and user secrets differently. A partner secret found in a public repository is reported to its issuer. A user secret creates a secret scanning alert when it is found in a public or private repository. Both processes begin with detection, but the recipient of the signal and the repository scope differ. Source
The two Anthropic key types are now included in push protection by default. Push protection checks changes as they are being sent to GitHub and blocks a commit containing a supported secret before it enters the repository. The default applies to repositories where secret scanning is enabled, including free public repositories. It adds a prevention point before the later alerting path for credentials already detected in code. Source
GitHub named only the two Anthropic key formats in the expanded default push-protection list. The Salesforce token and Cloudsmith key appear as new detection types in this announcement. Grouping all three providers under the same default blocking behavior would overstate the scope. The stated Anthropic protection also depends on secret scanning being enabled for the repository. Source
OYOPICK’s Take
The practical advance is moving protection for AI API keys one step earlier, from an alert after discovery to a block before the commit lands. A solo developer or small team experimenting with the Anthropic API can easily paste a key while arranging environment variables or sample code. Including free public repositories in the stated default gives those projects a defensive checkpoint before they have assembled separate security tooling.
Detection, blocking and revocation remain separate stages. A detector recognizes a supported format, push protection stops a supported commit, and issuer reporting applies to partner secrets in public repositories. Evaluating protection therefore requires looking at which keys reach which stage, rather than treating the presence of secret scanning as one uniform outcome.
As AI services multiply, one project is increasingly likely to handle API keys from several providers. A broader supported-pattern list, wider default blocking and clearer status from issuers after a report could reduce the number of provider-specific exposure procedures developers must remember. The result will depend on detector coverage, whether scanning is enabled for each repository, and how quickly providers actually revoke or rotate reported credentials.