NewsEditorialSource: GitHub
GitHub adds default push protection for Anthropic service and user API keys
GitHub announced on October 13, 2026, that secret scanning detects Anthropic service and user API keys and includes both types in default push protection. GitHub says repositories with secret scanning enabled, including free public repositories, block commits containing those keys. The announcement also lists a Cloudsmith API key detector and names Salesforce as a scanning partner for Marketing Cloud tokens. Earlier GitHub updates listed those Cloudsmith and Salesforce credential types, leaving the scope of their October changes unclear.
Why it matters
The Anthropic additions could help developers catch credentials before publishing them, but default detector coverage does not establish that every repository has protection enabled. Teams should check repository and organization settings and bypass permissions, because GitHub documents separate user and repository protections. MustHave.ai reported the additions but said it had not tested a detector against a repository.
Attribution
Sources
- 1GitHubSecret scanning blocks Anthropic keys by default, adds SalesforceSource published (UTC)
- 2MustHave.aiGitHub Now Blocks More Anthropic Keys: Check Your Repository’s Push ProtectionSource published (UTC)
- 3GitHubSecret scanning updates - June 2026Source published (UTC)
- 4GitHubGitHub secret scanning — coverage updateSource published (UTC)
- 5GitHubPush protection
Read the original source for full details and context.