GitHub push protection now blocks Anthropic API keys by default
Serguey Asael Shinder2 min readGitHub's secret scanning gained new detectors on 13 October 2026, and for two of them it went a step further than detection: commits containing them are now blocked by default.
What is blocked. The two new Anthropic secret types, anthropic_service_api_key and anthropic_user_api_key, have been added to the set of detectors included in push protection by default. According to the changelog, repositories with secret scanning enabled — explicitly including free public repositories — will have commits that contain these keys rejected at push time. The developer pushing the commit sees the block before the key reaches the remote, which is the point at which a leak is still cheap to undo.
What is only detected. A third new detector covers Cloudsmith API keys (cloudsmith_api_key). It produces alerts but is not listed among the push-protection defaults. GitHub distinguishes the two outcomes in the same post: user secrets generate secret scanning alerts in public or private repositories, while partner secrets found in public repositories are reported to the issuer.
A new partner. Salesforce has joined the secret scanning partner programme for the salesforce_marketing_cloud_api_oauth2_token type. When such a token turns up in a public repository, GitHub forwards it to Salesforce so the credential can be revoked or rotated before it is abused — the repository owner does not have to act first for the issuer to know.
What changes for teams. The practical difference is who has to act. Because the two Anthropic types sit in the default set, the block applies wherever secret scanning is on, without a repository administrator opting these types in one by one. The announcement is about new pushes: a key that already sits in a repository's history is not removed by it and still has to be revoked or rotated at the provider.
GitHub lists all supported secret types in its secret scanning documentation.
Source: GitHub Changelog, "Secret scanning blocks Anthropic keys by default, adds Salesforce" — https://github.blog/changelog/2026-10-13-secret-scanning-blocks-anthropic-keys-by-default-adds-salesforce