GitHub secret scanning adds a Supabase-credential detector that blocks the commit

GitHub's secret scanning with push protection is free and zero-config on public repositories, and a June 2026 update added a dedicated detector for Supabase credentials that blocks the offending commit before it lands. Supabase itself auto-revokes keys it spots leaked in public repos. On private repositories this protection is a separately-licensed paid add-on — so it is off unless you've bought it.

What it means One of the most common AI-built-app failures is the database key shipped to the browser; free push protection on a public repo catches a class of that at commit time — but know which tier you're on.