GitHub has extended its secret scanning service to recognize credentials from Salesforce, Anthropic, and Cloudsmith, and it now blocks commits that contain Anthropic API keys by default through push protection. The update also formalizes a partnership with Salesforce so that discovered tokens are automatically forwarded to the vendor for possible revocation.
New secret types and default push protection
The scanner now flags four additional provider secret types: salesforce_marketing_cloud_api_oauth2_token, anthropic_service_api_key, anthropic_user_api_key, and cloudsmith_api_key. For the two Anthropic keys, the detection rules are included in the push‑protection bundle, meaning any push that introduces these secrets into a repository – public or private – will be rejected automatically. This behavior applies to all repositories that have secret scanning enabled, including free public ones.
Partner reporting workflow
When a secret belonging to a partnered provider appears in a public repository, GitHub forwards the secret to the provider. The partner can then rotate or revoke the credential before an attacker can exploit it. Salesforce is the newest partner in this program, so any salesforce_marketing_cloud_api_oauth2_token found publicly will be reported to Salesforce for remediation. User‑owned secrets continue to generate alerts but are not automatically reported to an external party.
Operational impact for CI/CD and repository policies
Teams that already enforce secret scanning will see an immediate increase in alert volume for the newly supported types. Because Anthropic keys are now blocked at push time, developers will need to ensure those keys are never checked in, perhaps by moving them to secret‑management solutions or environment variables. Existing CI pipelines that rely on committing configuration files may need to add pre‑commit checks or adjust secret‑masking steps to avoid false rejections. The partnership model also means that compliance processes can reference the automatic vendor‑notification as part of incident‑response playbooks.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Validate that secret scanning is enabled on all relevant repositories and confirm the push‑protection setting includes the new Anthropic detectors. Review any existing workflows that handle Salesforce tokens to ensure they do not inadvertently expose them in public repos. Finally, monitor alert dashboards for the added secret types and update internal guidelines to treat vendor‑reported findings as actionable security events.