GitHub's AI secret check can cost credits even when it blocks nothing.
By Lior AharonovFounder, 7IT Solutions ·
On Wednesday 7 October 2026, GitHub moved AI-detected password alerts to a purpose-built secret detection model, at no extra charge for GHSP and GHAS customers. Its new opt-in push protection check is in private preview and will consume GitHub AI Credits. GitHub says a check can consume credits even if it doesn't block a push.
The database password with no recognizable token format is the kind a pattern scanner can miss. This model reads the code around it. But once your organization turns it on, pushes carry a meter, billed to the organization that owns the repository.
Decide now who in your organization may enable AI push protection, and set an AI Credits budget before the public preview. Billing starts only when your organization opts in and enables it.
Paying to catch a leaked password is cheap. Paying without a budget is how security tools get switched off.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.