GitHub secret scanning now blocks Anthropic API keys by default
Push protection covers Anthropic service and user API keys without any setup, and Salesforce joins as a secret scanning partner for automatic revocation.
GitHub published a changelog entry on 13 October adding new secret types to its scanning coverage from Salesforce, Anthropic and Cloudsmith. The notable change: anthropic_service_api_key and anthropic_user_api_key are now blocked by push protection by default, with no admin setup required. That default applies to any repository with secret scanning enabled, including free public repositories.
Salesforce also became a secret scanning partner, which means GitHub forwards a detected Salesforce Marketing Cloud OAuth2 token straight to Salesforce for revocation, the same arrangement it already has with providers like AWS and Stripe. Cloudsmith API keys are now detected too, though Cloudsmith isn’t listed as a partner, so there’s no automatic revocation path for those.
Why it matters: Anthropic API keys have become one of the more common things sitting in local .env files and agent configs, and this closes that gap without anyone needing to turn a setting on. If you commit one by accident, GitHub now stops the push itself rather than waiting for a scan to flag it after the fact.