GitHub has expanded its protection against API keys accidentally entering repositories. Its 13 October 2026 update adds two Anthropic key types, anthropic_service_api_key and anthropic_user_api_key, to default push protection coverage. For small software teams building AI integrations, the useful next step is to check the protection settings of the repositories that contain that work.
What changed
According to GitHub, secret scanning gained detectors for those two Anthropic key types and cloudsmith_api_key. Only the two Anthropic types are listed in this announcement’s expansion of default push protection coverage. The addition of the Cloudsmith detector does not establish the same change for Cloudsmith.
Secret scanning looks for supported secrets, while push protection can stop changes containing them from being pushed to a repository. They are separate controls, which makes the phrase “by default” important to interpret carefully.
What a team should check
GitHub’s release describes automatic blocking for repositories with secret scanning enabled. However, its setup documentation separately requires enabling Push protection. The announcement should therefore not be treated as confirmation that the relevant protection is already active in every repository.
A repository owner or responsible administrator should open Settings, go to Advanced Security, and check the actual status of Secret Protection and Push protection. If the organisation manages these settings, ask its administrator to confirm the configuration. Do not test the feature by putting a real key into code.
Secret scanning runs automatically and free of charge for public repositories. Private and internal organisation repositories require GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud. A team keeping its code private needs to check both the setting and its plan’s access to the feature.
Where coverage stops
GitHub’s documentation says push protection supports only the most recent token versions it can identify confidently. A push that is not blocked does not prove that the changes contain no secrets, or that every Anthropic key format is covered.
Our practical recommendation for a small business is to give someone responsibility for checking the settings and reviewing alerts, and to keep keys out of source code. A key that has already been exposed needs a separate response to that exposure, beyond adjusting scanning settings. This announcement describes broader coverage; it provides no measured cost savings or evidence of a specific incident being prevented.
Prepared by the NADALI editorial team using AI
GitHub’s announcement was checked on 13 October 2026; the three documentation pages were rechecked on 14 October 2026. Announcement date: 13 October 2026.
