AI Agent · Copilot · GitHub · Microsoft · GitHub Blog
Secret protection must scale with software
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
Today, one in three pull requests on GitHub involves an AI agent.
Key facts
- Between Q2 2024 and Q2 2026, screened pushes grew 2.84 times while pushes carrying credentials grew 2.59 times
- Erin Havens is a Product Manager at GitHub, focused on security products. 100+ ships across products like Secret Protection and Dependabot (and counting)
- Over the same period, the share of push-path blocks overridden by developers fell linearly from 6.63% to 3.93%
- The mean time to manually revoke a secret hovers around 40 days; roughly one in five took more than 90 days
Summary
If developers and agents move faster, they have a responsibility to ensure protection keeps up with the accelerated rate of code creation. This is a pivotal point for leaked secrets. In this essay, the reporter share the nine quarters of data behind that claim. A new secret appears in publicly visible code about once every two seconds, doubling yearly for the past three years.