GitHub Secret Scanning Now Blocks Anthropic Keys by Default, Adds Salesforce Detection
GitHub Secret Scanning detects and blocks new Anthropic secret types with push protection by default and expands detection to include Salesforce and Cloudsmith secrets.
What changed?
GitHub Secret Scanning now detects secret types from Salesforce, Anthropic, and Cloudsmith. Notably, Anthropic secret types—anthropic_service_api_key and anthropic_user_api_key—are now blocked by default with push protection. Salesforce and Cloudsmith API keys are also automatically detected. When provider secrets appear in public repositories, GitHub forwards them to the relevant partner for revocation or rotation. Partner secrets found in public repos are reported automatically, while user secrets generate alerts in both public and private repositories.
Why does it matter to an everyday developer?
This enhancement reduces the risk of accidentally exposing sensitive Anthropic, Salesforce, or Cloudsmith credentials. For Anthropic secrets, push protection means any commit containing these will be blocked by default when secret scanning is enabled, including in free public repositories. Automatically forwarding exposed secrets to providers allows for quicker credential revocation, decreasing the likelihood of credential abuse. Developers who use Anthropic, Salesforce, or Cloudsmith APIs are directly affected and benefit from improved safety for their projects.
What can the developer do now?
Ensure GitHub Secret Scanning is enabled for your repositories. When working with Anthropic, Salesforce, or Cloudsmith API keys, be aware that GitHub will now proactively block the accidental inclusion of Anthropic secrets in commits and will alert for Salesforce and Cloudsmith secrets. Regularly review secret scanning alerts and follow provider recommendations if a secret is reported or revoked. This proactive approach helps minimize the exposure window for compromised credentials.