GitHub Now Blocks Two More Anthropic Key Types at Push. Here’s What It Still Misses

Description and use

GitHub now blocks two new Anthropic key types on push, but private repos without enabled protection remain vulnerable. Recommended actions: enable push protection, use service keys for agents, and remove .env from the repo.

Problem

Anthropic API keys can be accidentally committed to Git repositories, exposing them to public or private repositories and risking unauthorized access.

Outcome

By enabling push protection, using dedicated service account keys for agents, and removing .env files from the repository, developers can prevent accidental exposure of Anthropic keys and maintain secure workflows.

Workflow

• 1. Enable repository push protection where possible. 2. Assign separate Anthropic service account keys to agents and CI. 3. Add ".env" to .gitignore, remove it from the index with git rm --cached .env, and audit history for Anthropic keys using git log --all -p | grep -c 'sk-ant-'.
• 4. If a real key is found, rotate it in the Claude Console before rewriting history.

Evidence

GitHub now detects two new Anthropic secret types, anthropic_user_api_key and anthropic_service_api_key, and that push protection blocks both by default.

Source

A block is not a wall. The same docs say that by default "anyone with write access to the repository can bypass push protection by specifying a bypass reason."

Source

git rm --cached .env fails harmlessly if .env was never tracked. The count includes placeholders and removed lines, so look at the matches before you act.

Source