面向泄露密钥检测的专用模型

无论是亲自编写代码，还是与 AI Agent 协作开发，密钥保护都应跟上你的软件构建方式。借助这款新的专用模型，我们正将具备上下文感知能力的检测扩展到更多开发者工作流中，帮助你在密钥暴露前发现它们。

今天，我们分享在 Secret scanning alerts、Push protection 和 GitHub Copilot 安全审查中引入 AI 密钥检测的计划。这些功能利用 GitHub 为密钥检测专门微调的模型。该模型会读取周边代码，以识别可能的凭据，包括没有可识别 Token 格式的密码；它不会生成代码或自然语言文本。

模型可用性：

• 已启用 AI 检测密码警报的客户，将自动升级至新模型。
• Push protection 中的 AI 检测密钥现已提供私有预览。
• 适用于 Copilot CLI 和 Copilot App 的 GitHub Copilot /security-review 命令中的 AI 密钥扫描，即将以私有预览形式推出。

**AI 检测密钥警报将继续包含在 GHSP 和 GHAS 中，不额外收费。**Push protection 和安全审查命令中新增的可选检查将消耗 GitHub AI Credits。

我们会在功能更广泛可用前提前公布其计划中的计费模式，以便你在启用前审查访问权限和支出。

本通知适用于以下功能：

• 适用于 GitHub Secret Protection（GHSP）和 GitHub Advanced Security（GHAS）的 Push protection 中 AI 检测密钥
• 使用 GitHub Copilot /security-review 命令进行的 AI 密钥扫描

未来数周内，这些可选检查将开始引入 AI Credit 用量。

从今天开始，现有的 AI 检测密钥警报扫描将自动切换至新模型，GHSP 和 GHAS 客户无需额外付费。这些扫描仍包含在 GHSP 和 GHAS 中，与新增的、消耗 Credits 的检查相互独立。

该模型还将在 GHES 3.23 中通过公开预览提供 AI 检测警报。这项功能包含在企业现有购买的 GHSP 和 GHAS 服务中。

AI Push protection 会在推送时检查非结构化凭据，使你有机会在密钥进入仓库历史记录前将其移除。**该功能将面向购买 GHSP 或 GHAS 的 GitHub Enterprise Cloud 或 GitHub Teams 客户提供。**管理员必须根据组织或企业的策略启用该功能。

计划中的 AI Credit 用量将向拥有仓库的组织计费。即使检查没有阻止推送，也可能消耗 Credits。除企业托管用户（EMU）的用户命名空间仓库外——该情况下用量归属于推送者，并计入该用户分配的 Credits——AI Credit 用量将归属于组织，且不会计入任何特定用户分配的 Credits。用量将显示在 AI usage insights 的 AI Credit consumption 中，SKU 为 Secret Protection AI Credits。

一旦你的组织选择加入公开预览并启用该功能，即开始计费。

在受支持的 Copilot CLI 或 Copilot App 会话中，可在提交、推送或请求 Pull Request 审查前使用 /security-review。该命令会审查当前变更中的安全漏洞，并返回按优先级排列的发现结果及修复建议。

开发者和编码 Agent 可以使用内置的 security-review 专家 Agent，在获得适当授权后处理已确认的问题，并在修复后再次运行审查。该审查为只读操作，现有 Copilot 策略和计费规则仍然适用。

**GitHub 即将把密钥分类器的检查加入现有基于 LLM 的审查中。**使用这些检查无需 GHSP 或 GHAS 许可证。除审查现有用量外，这些新增检查还将消耗 AI Credits。你的有效 Copilot 计划所对应的计费账户将承担这部分用量，并在 AI usage insights 中归类为 GHSP。一旦你选择加入公开预览并启用该功能，即开始计费。

**这些新增检查默认关闭。**运行 /security-review 不会启用它们。你必须在计划和策略允许的情况下主动选择启用。未经明确授权，Agent 不应启用消耗 Credits 的功能，也不应更改策略或预算。

请参阅 Copilot CLI security-review agent 文档以及 Copilot App 会话中的 security-review 使用说明。

GitHub 托管计划、GHSP 许可证和 Copilot 订阅彼此独立。GitHub Enterprise（GHE）包括 GitHub Enterprise Cloud（GHEC）和 GitHub Enterprise Server（GHES）。Copilot Enterprise 是独立的 Copilot 订阅。

组织和企业管理员将能够通过策略禁用这些新功能，并为其 AI Credit 用量设置预算。选择加入不会绕过这些控制措施。适用的包含 Credits 及任何额外付费用量，将遵循账户的计费策略和限额。

如需设置专用预算，请打开 Billing and licensing，然后选择 Budgets and alerts。选择 SKU-level budget，产品选择 Advanced Security，SKU 选择 Secret Protection AI Credits。all AI Credits budget 可以覆盖多个消耗 Credits 的 SKU。

仅设置预算警报不会停止用量。如果你希望限制支出，请在可用时配置 Stop usage when budget limit is reached。

如果你已在私有预览中使用 AI Push protection，在本次计费变更生效后继续使用将消耗 AI Credits。如果不希望产生此类用量，请提前将其禁用。AI 检测警报扫描仍包含在服务中，不额外收费。

在启用或继续使用这些新检查前，请审查上述适用资格、AI Credit 定价和计费详情，以及你的预算设置和按用量计费文档。

Secret protection should keep pace with the way you build software, whether you write code yourself or work with an AI agent. With our new purpose-built model, we’re bringing context-aware detection into more developer workflows to help you catch secrets before they’re exposed.

Today, we’re sharing plans for AI secret detection across secret scanning alerts, push protection, and GitHub Copilot security reviews. These features leverage GitHub’s fine-tuned model for secret detection. It reads surrounding code to identify likely credentials, including passwords without a recognizable token format, without generating code or prose.

Model availability:

• Customers with AI-detected Password alerts have automatically been upgraded to the new model.
• AI-detected secrets in push protection is available in private preview.
• AI-based secret scanning with the GitHub Copilot/security-review command for the Copilot CLI and Copilot app available soon in private preview.

AI-detected secret alerts will remain included in GHSP and GHAS at no additional charge. The new opt-in checks for push protection and the security review command will consume GitHub AI Credits.

We’re sharing their planned billing model ahead of broader availability so you can review access and spending before enabling them.

This notice applies to the following features:

• AI-detected secrets in push protection for GitHub Secret Protection (GHSP) and GitHub Advanced Security (GHAS)
• AI-based secret scanning with the GitHub Copilot /security-review command

AI Credit usage for these opt-in checks will be introduced in the coming weeks.

Starting today, existing AI-detected secret alert scans will automatically switch to the new model at no additional charge for GHSP and GHAS customers. These scans remain included in GHSP and GHAS, separate from the new credit-consuming checks.

The model will also bring AI-detected alerts to GHES 3.23 in public preview. This feature is included with an enterprise’s existing purchase of GHSP and GHAS.

AI push protection checks for unstructured credentials at push time, giving you a chance to remove a secret before it enters repository history. The feature will be available to customers on GitHub Enterprise Cloud or GitHub Teams with a purchase of GHSP or GHAS. An administrator must enable it, subject to your organization’s or enterprise’s policies.

The planned AI Credit usage will be billed to the organization that owns the repository. A check can consume credits even if it doesn’t block a push. Outside of user-namespace repositories for enterprise-managed users (EMUs), where usage is attributed to the pusher and apply to the user’s allocated credits, AI Credit usage will be attributed to the organization and will not apply to any specific user’s allocated credits. Usage will be listed under AI Credit consumption for the Secret Protection AI Credits SKU in your AI usage insights.

Billing begins once your organization opts into the public preview and enables the feature.

In a supported Copilot CLI or Copilot App session, use /security-review before committing, pushing, or requesting pull request review. It reviews active changes for security vulnerabilities and returns prioritized findings with remediation suggestions.

Developers and coding agents can use the built-in security-review specialist, address confirmed findings with the appropriate authorization, and run the review again after fixes. The review is read-only—existing Copilot policies and billing apply.

Coming soon, GitHub is adding checks from the secret classifier alongside the existing LLM-based review. You don’t need a GHSP or GHAS license to use these checks. The new checks will consume AI Credits in addition to the review’s existing usage. The billing account for your active Copilot plan will receive this usage, reported under GHSP in your AI usage insights. Billing begins once you opt into the public preview and enable the feature.

The new checks will be off by default. Running /security-review won’t enable them. You must opt in where your plan and policies allow. Agents shouldn’t enable credit-consuming features or change policies or budgets without explicit authorization.

See the Copilot CLI security-review agent documentation and security-review instructions for Copilot App sessions.

GitHub hosting plans, GHSP licenses, and Copilot subscriptions are separate. GitHub Enterprise (GHE) includes GitHub Enterprise Cloud (GHEC) and GitHub Enterprise Server (GHES). Copilot Enterprise is a separate Copilot subscription.

Organization and enterprise administrators will be able to disable the new capabilities by policy and set budgets for their AI Credit usage. Opting in won’t override those controls. Applicable included credits and any additional paid usage follow your account’s billing policies and limits.

To set a dedicated budget, open Billing and licensing and select Budgets and alerts. Choose SKU-level budget , Advanced Security as the product, and Secret Protection AI Credits as the SKU. An all AI Credits budget can cover multiple credit-consuming SKUs.

Budget alerts alone don’t stop usage. Configure Stop usage when budget limit is reached where available if you want a spending cap.

If you’re already using AI push protection in private preview, continued use after this billing change takes effect will consume AI Credits. Disable it beforehand if you don’t want that usage. AI-detected alert scanning remains included at no additional charge.

Before enabling or continuing the new checks, review the eligibility, AI Credit pricing, and billing details above, along with your budget settings and documentation for usage-based billing.