GitHub extends AI secret detection to push protection, both usage-based

WHY IT MATTERS

For teams already paying extra for Advanced Security as a standalone add-on since July 2025, this stacks another usage-based line item onto what used to be a single security line in the budget. Watch whether GitHub keeps extending usage-based billing into other security products next, the way it spread from Copilot into the cloud sandbox and now Secret Protection.

BY THE NUMBERS

• GitHub's first pricing change in 131 days, vs. a ~105-day average gap
• Third usage-based billing move since the May Copilot shift
• Advanced Security became a paid add-on in July 2025
• 9 of 53 tracked comparisons have been real changes since April 2024

THEIR RATIONALE

GitHub frames this as closing a detection gap: regex-based scanning catches structured tokens and keys, but plain-text passwords and other unstructured secrets slip through until a human catches them. AI detection for push protection stops them before the push completes rather than flagging them after the fact. This is GitHub's first pricing change in 131 days, well past its roughly 105-day average gap, and its third move tied to usage-based billing since it shifted Copilot itself onto that model earlier this year.

THE SIGNAL

The pattern matters more than the single feature: GitHub has now put three separate things on usage-based billing since the Copilot shift — the billing model itself, June's cloud sandbox add-on, and now AI secret detection. That's a deliberate push to meter AI-adjacent features by consumption rather than bundle them into a flat seat price. Across the wider index, 201 pricing changes at 153 companies have touched credits-and-usage billing in the last 180 days, about one in nine of all tracked changes, so GitHub metering a security feature this way fits a broader market drift away from flat pricing. The twist here is that this isn't optional tooling — it's a build-time security control, which raises the stakes of billing it by usage.

IN CONTEXT

GitHub has leaned into usage-based billing since shifting Copilot itself onto that model in May, following up a month later with a usage-priced cloud sandbox add-on for Copilot workflows — this is the third move in that pattern. It lands 131 days after GitHub's last pricing change, well past its roughly 105-day typical cadence, and continues a history of carving security features out of flat pricing: Advanced Security left the Enterprise plan for a paid add-on in July 2025. Across the wider index, 201 pricing changes at 153 companies have touched credits-and-usage billing in the last 180 days — about one in nine of all tracked changes — so metering an AI security feature by usage fits a market-wide drift away from flat seat pricing.