Secret scanning now detects Anthropic, Salesforce, and Cloudsmith secrets
Secret scanning has been expanded to detect new secret types from Salesforce, Anthropic, and Cloudsmith, with Anthropic secrets now blocked by default via push protection. This helps prevent accidental exposure of third-party credentials in repositories.
Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith, with the new Anthropic secret types blocked with push protection by default.
New secret scanning partner
Salesforce is now a secret scanning partner.
When a provider’s secret is found in a public repository, GitHub forwards it to the relevant partner so they can revoke or rotate the credential before it can be abused.
| Provider | Secret type |
|---|---|
| Salesforce | salesforce_marketing_cloud_api_oauth2_token |
Detectors added
Secret scanning now automatically detects the following new secret types in your repositories.
| Provider | Secret type |
|---|---|
| Anthropic | anthropic_service_api_key |
| Anthropic | anthropic_user_api_key |
| Cloudsmith | cloudsmith_api_key |
Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories.
Push protection defaults expanded
The following detectors are now included in push protection by default. Repositories with secret scanning enabled, including free public repositories, will have commits containing these secrets automatically blocked.
| Provider | Secret type |
|---|---|
| Anthropic | anthropic_service_api_key |
| Anthropic | anthropic_user_api_key |
Learn more
Learn more about secret scanning and see the full list of supported secrets in our documentation. Let us know what you think in the community discussion.
The post Secret scanning blocks Anthropic keys by default, adds Salesforce appeared first on The GitHub Blog.
Source: original entry ↗
More from GitHub
Follow GitHub to get its new changes in your feed and email digest.
GitHub App improvements for least privilege and management
GitHub has released improvements to GitHub Apps that enable developers to migrate away from classic personal access tokens, enhance app management capabilities, and request fewer sensitive permissions for better security.
Gemini 4 Argon now available in GitHub Copilot
Google's Gemini 4 Argon frontier model is now generally available in GitHub Copilot, designed for complex coding, agentic, and reasoning tasks to enhance developer productivity.
Audit GitHub Code Quality finding dismissals and reopenings
Users can now review manual dismissals and reopenings of GitHub Code Quality findings in their organization or enterprise audit log, enabling better tracking and governance of code quality decisions.