Improving Secret Scanning Reliability: Reducing False Positives at Scale

GitHub operates Secret Scanning to protect developers and organizations, and has introduced a new approach to address the False Positives problem that occurs in large-scale environments. Too many false positives increase developer fatigue and delay response to actual security issues.

To solve this, GitHub collaborated with Microsoft Security & AI's Agents Offense team to add LLM (Large Language Model)-based contextual reasoning to the verification stage. In addition to the existing pattern matching approach, this method analyzes how a detected value is actually used within the code.

The core of the new approach is not simply providing more code, but providing 'Better Context'. The system extracts and verifies the following high-signal information:

• Whether a value, after being assigned to a variable, is used in an API request, an authentication header, a database client, or a Cloud SDK call
• Contextual evidence on whether the value is a simple string or is actually used for a security-sensitive purpose

This approach does not change the existing detection logic or coverage, but generates High-confidence alerts at the verification stage, helping developers focus only on actual risks.