GitHub's official changelog confirms two Anthropic key detectors and default push-protection coverage.
GitHub push protection now blocks exposed Anthropic API keys
2026-10-14Verified announcementADOPT
GitHub secret scanning now recognizes Anthropic service and user API keys. Push protection blocks both key types by default in repositories where secret scanning is enabled, including eligible free public repositories. This is a generally available preventive control, not evidence that a particular repository leaked a key.
Availability: generally available
What this means for you
Teams using Claude APIs gain a default guardrail at commit time, reducing the chance that a live credential reaches repository history. Organization owners still need to verify policy coverage and rotate any previously exposed key.
Evidence & related material
Technical details & scores
| Availability | generally available |
|---|---|
| Detectors | anthropic_service_api_key and anthropic_user_api_key |
| Default Behavior | push protection blocks detected keys by default where secret scanning is enabled |
| Coverage | includes eligible free public repositories |
| Time Basis | GitHub changelog published 2026-10-13T16:12:36Z |
Technical impact 2
Engineering value 5
Adoption signal 4
Maturity 5
Verification cost 1
Risk 1