What happened
GitHub has published details on how it evaluates large language models before shipping them into production systems, using its secret-scanning pipeline as the case study. Working with Microsoft's Security & AI Agents Offense team, GitHub added context-aware LLM reasoning to the verification step that decides whether a detected string is a real credential or a false alarm, checking how a value is actually used in the surrounding code rather than relying on pattern-matching alone. In evaluations against hundreds of customer-confirmed false positives, the approach cut false positives by 75.76%, beating GitHub's own 65% target.
Why it matters for your business
The result matters, but the process is the more reusable part for any team shipping LLM-backed features: GitHub treats every prompt, model, or dataset change as something that can silently regress the system, versions all three, and re-runs evaluation whenever a major component changes, the same discipline as integration testing for conventional code. It also does not treat false positives and false negatives as interchangeable: in secret scanning, missing a real leaked credential is worse than one extra alert, so the two error types get different tolerance thresholds.
What to watch next
GitHub's approach of using an LLM-as-judge only for clear-cut cases, and routing ambiguous ones to human review, is a pattern likely to show up in other GitHub AI features as the company keeps folding LLM reasoning into existing security tooling.