GitHub adds usage-based AI secret detection to push protection
By Rob Litterst, Co-founder, PricingSaaS
Published Last updated
GitHub’s pricing page · Change detected
What changed
GitHub renamed Secret Protection's "Copilot secret scanning" feature to "AI detection for alerts" — it still scans existing code the same way, just under a new name. It also added a new "AI detection for push protection" feature that uses AI to catch unstructured secrets, like plain-text passwords, and blocks a push before they land in the repo. The push-protection feature is billed usage-based on the Team and Enterprise plans, while AI detection for alerts stays included, extending the usage-pricing approach GitHub brought to Copilot earlier this year.
Why it matters
For teams already paying for Advanced Security as a separate add-on since July 2025, AI push protection adds a usage-based line on top of that add-on price, while AI alerts stay included. Watch whether GitHub keeps extending usage-based billing into other security products next, the way it spread from Copilot into the cloud sandbox and now Secret Protection.
In context
GitHub has leaned into usage-based billing since shifting Copilot itself onto that model in May, following up a month later with a usage-priced cloud sandbox add-on for Copilot workflows — this is the third move in that pattern. It lands 131 days after GitHub's last pricing change, well past its roughly 105-day typical cadence, and continues a history of carving security features out of flat pricing: Advanced Security left the Enterprise plan for a paid add-on in July 2025. Across the wider index, 201 pricing changes at 153 companies have touched credits-and-usage billing in the last 180 days — about one in nine of all tracked changes — so metering an AI security feature by usage fits a market-wide drift away from flat seat pricing.
What people are saying
“False positives are why people disable these checks. If the context part actually works, this one stays on.”
View original“GitHub's new model for leaked secrets comes in two parts, and only one of them is free (changelog, Oct 7). Included in Secret Protection / Advanced Security: - AI-detected secret alerts, already switched to the new model Billed in AI Credits once you opt in, starting in the coming weeks: - AI checks in push protection, charged to the org that owns the repo - secret checks in Copilot's /security-review, charged to your Copilot plan The two details that change the bill: a push check can consume credits even when it doesn't block the push, and budget alerts alone don't stop usage. For a real cap, set a Secret Protection AI Credits budget with "Stop usage when budget limit is reached". If you're on the push protection private preview, continued use after billing starts consumes credits. Disable it beforehand if you don't want that.”
View original