---
title: "GitHub Push protection blocks Anthropic API keys by default; secret scanning adds Salesforce and Cloudsmith: 2026-10-13 | Harbyn"
description: "GitHub Push protection blocks Anthropic API keys by default; secret scanning adds Salesforce and Cloudsmith, announced Oct 13, 2026."
canonical: "https://harbyn.com/changes/github/2026-10-13-secret-scanning-blocks-anthropic-keys-by-default-adds-salesforce"
last-updated: 2026-10-13
---

# GitHub Push protection blocks Anthropic API keys by default; secret scanning adds Salesforce and Cloudsmith

Markdown version of <https://harbyn.com/changes/github/2026-10-13-secret-scanning-blocks-anthropic-keys-by-default-adds-salesforce>.

Behavior change - GitHub. low severity. In effect.

Push protection now blocks anthropic\_service\_api\_key and anthropic\_user\_api\_key by default, so pushes containing them are rejected in repositories with secret scanning enabled, including free public ones. Secret scanning also detects cloudsmith\_api\_key, and Salesforce joins the partner program for salesforce\_marketing\_cloud\_api\_oauth2\_token found in public repositories.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [GitHub](https://harbyn.com/vendors/github.md) |
| Kind | Behavior change |
| Severity | low |
| Status | In effect |
| Announced | Oct 13, 2026 |
| Added to Harbyn | Oct 13, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://github.blog/changelog/2026-10-13-secret-scanning-blocks-anthropic-keys-by-default-adds-salesforce> |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses GitHub, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://github.blog/changelog/feed/> (changelog, fetched 2026-10-13 19:21 UTC, sha256 `1126065e3cc7e337b9341744e18516f196d3f5c3accf1ca4fb6bfd5e4b3c52ec`)

## Related changes

### More from GitHub

- [Copilot managed settings can force a policy refresh at startup and require a minimum client version](https://harbyn.com/changes/github/2026-10-13-enterprise-managed-settings-enforcement-updates.md) (Behavior change, announced Oct 13, 2026)
- [Withdrawn Dependabot alerts return 410 Gone and send a withdrawn webhook action](https://harbyn.com/changes/github/2026-10-13-improved-detection-for-withdrawn-dependabot-alerts.md) (Behavior change, announced Oct 13, 2026)
- [Email notifications for repository push events retired](https://harbyn.com/changes/github/2026-10-15-email-notifications-for-repository-push-events-have-been-retired.md) (Retirement, effective Oct 15, 2026)
- [Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave GitHub Copilot on 2026-11-16](https://harbyn.com/changes/github/2026-10-15-upcoming-deprecation-of-selected-github-copilot-models-in-mid-november.md) (Retirement, effective Nov 16, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: ORDER\_CHANGE notifications add PreFulfillmentStatusChange for Amazon Autos](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-3.md) (effective Oct 28, 2026)
- [BigCommerce: 301 redirects will apply only to storefront channels](https://harbyn.com/changes/bigcommerce/2026-10-07-301-redirects-now-apply-to-storefront-channels-only.md) (effective Nov 10, 2026)
- [Jira / Atlassian Cloud: New IP address ranges in use from January 1, 2027](https://harbyn.com/changes/atlassian-jira/2026-10-16-atlassian-cloud-adds-new-ip-address-ranges.md) (effective Jan 1, 2027)
- [Let's Encrypt: Default certificate lifetime changes to 64 days](https://harbyn.com/changes/letsencrypt/2026-10-07-64-day-certificate-lifetimes-coming-feb-2027.md) (effective Feb 10, 2027)

[All upcoming deadlines](https://harbyn.com/deadlines.md)