A Claude key in Git: GitHub blocks the push by default

A leaked test-database password creates a risk that may never materialise.

A leaked LLM API key starts spending money as soon as someone else finds it. Bots have scanned public commits for keys for years.

Whoever finds a Claude or GPT key can use it for generation at your expense.

Without provider-console spending limits and alerts, overspending is noticed only when the bill arrives or the balance runs out.

Common leaks include committing .env files or leaving keys in Jupyter notebooks, MCP-server configuration or temporary scripts later added to a shared repository.

Another scenario remains our hypothesis: an AI coding agent sees a key in its context and inserts it as a literal string to make a test pass.

If the hypothesis is correct, more agent-written code will put keys in unexpected places more often.

GitHub compares pushed content against known secret patterns.

For some providers, GitHub also checks whether a discovered key is active.

The critical property is when checking happens: GitHub blocks the secret before it enters history, so no Git-history cleanup is needed.

History cleanup is expensive: the team rewrites Git history, force-pushes and has everyone recreate local clones.

The key still needs rotation because copies may remain in forks, local clones and CI caches.

The partner programme adds a second line of defence.

If a key reaches a public repository, GitHub notifies the provider, which revokes it without your team’s intervention. This protection is limited to GitHub.

Many CIS companies host code in self-managed GitLab or Gitea.

There, equivalent protection uses a server-side pre-receive hook and gitleaks or trufflehog in CI.

In our experience, basic setup takes about a day.

This is a good example of TTU, time to use: the check starts blocking keys from the next push.

Read AI Scan metrics carefully.

Finding counts alone say little: a scanner reporting 400 issues may simply overwhelm the team with noise.

Executives need two numbers. Remediation rate shows what share of findings the team resolves.

The accepted-autofix share shows whether developers accept the AI’s suggested corrections.

If the remediation rate does not improve, the scanner budget paid for reports.

A company buys a scanner to close vulnerabilities. An AI scanner that does not improve that number remains an expensive decoration.

Identity settings in Copilot telemetry address two management tasks.

The first is cost allocation: an executive can see which team and developer consume models without anyone reading their prompts.

The second use is incident investigation: if a key leaked from one machine, host.name narrows the search to a device, potentially cutting investigation from days to hours.

An administrator enables the option through managed settings; it is off by default.

In AI-native development and integration projects, we remove provider keys from people and agents. Developers, n8n workflows and MCP servers call LLM & Security Gateway using an internal token.

The gateway stores Anthropic Claude, OpenAI, Google Gemini, Sber GigaChat and YandexGPT keys, sets team spending limits and controls outbound data.

If an internal token leaks, it can be revoked centrally and the damage is bounded by the limit set beforehand.

Around the gateway, we configure a standard pipeline: developer pre-commit checks, server-side repository checks, secrets in a vault, and MCP tokens passed through environment variables.

The design looks simple, but making it work requires reviewing the team’s repositories, services and habits.

Companies often postpone this work until the first incident.