In its October 13, 2026 changelog, GitHub announced that push protection includes two Anthropic key patterns by default: anthropic_service_api_key and anthropic_user_api_key. GitHub says commits containing either pattern are automatically blocked in repositories with secret scanning enabled, including free public repositories. GitHub’s changelog describes the change; the repository’s scanning features and eligibility depend on its type and ownership.
What push protection blocks—and what Secret Scanning checks
Push protection checks a commit before it is pushed and blocks it when it contains a detected secret. GitHub says both Anthropic patterns are included in push protection by default, provided secret scanning is enabled for the repository.
Secret scanning also checks beyond incoming commits. GitHub says it scans Git history across all branches and periodically rescans repositories when it adds new secret types. That means a new detector can flag a matching secret in existing repository history, not just a new push.
GitHub also lists issue descriptions and comments, pull request titles, descriptions and comments, Discussions, wikis, and secret gists among the places Secret Scanning checks. GitHub’s Secret Scanning documentation describes those scan locations and the access conditions for different repository types.
Which repositories have Secret Scanning?
GitHub says public repositories receive Secret Scanning automatically at no charge. For other repository types, ownership and the organization’s GitHub plan matter:
| Repository type | Secret Scanning availability or requirement |
| Public | Runs automatically for free. GitHub includes free public repositories in the announced Anthropic push-protection scope when secret scanning is enabled. |
| Organization-owned private or internal | Requires GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud. |
| User-owned | Available on GitHub Enterprise Cloud with Enterprise Managed Users, or on GitHub Enterprise Server when the enterprise has GitHub Secret Protection enabled. |
For an organization’s private or internal repositories, the documented requirement is GitHub Secret Protection on one of the listed plans. Public repositories have a different path: GitHub says scanning runs automatically for free, and its changelog explicitly includes free public repositories in the Anthropic blocking announcement.
Other secret types in the announcement
The same changelog announced detection for Salesforce’s salesforce_marketing_cloud_api_oauth2_token and Cloudsmith’s cloudsmith_api_key. GitHub described Salesforce as a secret-scanning partner.
