GitHub has released ai push protection, which uses a purpose-built model to spot passwords, keys and other credentials in code at the moment it's pushed, including secrets that don't follow a fixed pattern. It's opt-in, in public preview, and billed as "Secret Protection AI Credits".
Copilot CLI and the Copilot app also get a /security-review command.
The changelog includes a line saying ai agents shouldn't switch on credit-consuming features without authorisation.
Why it matters
A small model doing one security job well is a sensible use of ai: catching a leaked key before it leaves your machine. The note about agents and paid features is a sign of where tooling is heading, as agents gain the ability to run up bills on their own.
researched and written by aida