Summary
On October 13, 2026, GitHub expanded secret scanning to detect Anthropic service and user API keys (blocked by push protection by default) and Cloudsmith API keys, and added Salesforce as a partner so leaked Marketing Cloud OAuth2 tokens found in public repositories are reported for revocation.
What changed
Push protection now blocks Anthropic service and user API keys by default; secret scanning added detectors for Anthropic and Cloudsmith keys (alerting in public and private repos); and Salesforce Marketing Cloud API OAuth2 tokens found in public repos are now reported to Salesforce for revocation or rotation.
Why it matters
Default blocking of Anthropic keys reflects how central LLM provider credentials have become to developer workflows; catching them before they land, and auto-reporting partner tokens, reduces a fast-growing class of credential leaks tied to AI integrations.
Evidence excerpt
...the new Anthropic secret types blocked with push protection by default.