Enabling push protection for AI-detected secrets

Block pushes that contain passwords and other unstructured secrets found using AI.

Who can use this feature?

Repository owners, organization owners, security managers, and users with the admin role

In this article

Note

Push protection for AI-detected secrets is in public preview and subject to change.

When you enable push protection for AI-detected secrets, GitHub uses AI to find and block generic secrets, such as passwords, that do not match any pattern.

Push protection for AI-detected secrets consumes AI credits in addition to your GitHub Secret Protection or GitHub Advanced Security license. See Push protection and GitHub Advanced Security license billing.

Prerequisites

To use scanning for AI-detected secrets, an enterprise owner must first set a policy at the enterprise level that controls whether the feature can be enabled and disabled for repositories in an organization. This policy is set to "allowed" by default.

Enabling push protection for AI-detected secrets for your repository

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security and quality" section of the sidebar, click Advanced Security.

  4. Under "Secret Protection", to the right of "Push protection for AI-detected secrets", toggle the setting to On.

Enabling push protection for AI-detected secrets for your organization

You can enable push protection for AI-detected secrets for repositories in your organization with a custom security configuration. Security configurations are collections of security settings that you can customize and apply at scale. See Creating a custom security configuration.