Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The five detectors cover a Lovable API Key, a Logfire Token, a Pydantic AI Gateway API Key and two Supabase token types.
- All five currently support user alerts. Only Lovable and the two Supabase types list partner notifications, which are separate from repository user alerts.
- None of the five currently lists push protection, validity checks, extended metadata or Base64 support. Detection support does not establish push-time blocking.
- Secret scanning runs automatically for free on public repositories. Organization-owned private and internal repositories need an eligible plan with GitHub Secret Protection enabled.
Which credential types were added? Match the exact names
GitHub announced these detectors on October 5, 2026. This guide uses the support table rechecked on November 6, rather than presenting the old announcement as a new launch that day. These are provider-specific credential patterns, which must be evaluated separately from AI detection of passwords without a fixed format.
Lovable Labs maps to lovable_api_key. Pydantic Services Inc. maps to logfire_token and pydantic_ai_gateway_api_key: the first is a Logfire Token and the second a Pydantic AI Gateway API Key. Do not combine the two merely because they share a provider.
Supabase maps to supabase_oauth_access_token and supabase_scoped_personal_access_token: an OAuth access token and a scoped personal access token. This list does not claim coverage of every key version or other credential issued by those platforms. Keep the exact secret type when checking support.
Who receives a user alert or a partner notification?
The current support table marks all five types as supporting User alert. Lovable and both Supabase types also support the Partner notification channel; the two Pydantic types do not carry that mark. An absent partner-notification mark does not mean public repositories have no user alerts for that type.
User alerts appear in a repository’s Security and quality tab. Partner notifications go directly to the credential’s issuing provider and are not displayed there as partner alerts; one credential type can support both channels independently. The October 5 announcement specifically says Lovable joined the partner program, allowing matching credentials found in public repositories to be forwarded to it.
The notification lets a provider take action such as revoking or rotating a credential. It does not establish that a particular key has already become invalid. Check the issuing platform’s actual state and your team’s response records when assessing your own exposure.
Why does detection support not guarantee a blocked push?
As checked on November 6, 2026, all five rows show no support for Push protection, Validity check, Metadata check or Base64. Push protection is a separate capability that can block a push; adding a secret-scanning detector does not automatically add that capability.
A successful push therefore does not prove these credential types were not exposed. Without validity checks, do not expect an alert to automatically establish whether the credential is still active. An unsupported Base64 column also means you cannot extend plain-text detection coverage to an encoded form.
For example, suppose a maintainer commits a Lovable API key and the push succeeds. This hypothetical illustrates the support boundary only: it does not establish that the key is safe, undetected or revoked. Never commit a real credential merely to test a detector.
Which repositories qualify?
GitHub’s documentation says secret scanning runs automatically for free on public repositories. Organization-owned private and internal repositories require GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud. An added detector does not automatically license a private repository.
For user-owned repositories, the current documentation lists GitHub Enterprise Cloud with Enterprise Managed Users, or GitHub Enterprise Server when the enterprise has GitHub Secret Protection enabled. Check ownership, visibility and hosting platform for your own repository; a personal Copilot subscription alone does not establish eligibility.
These public sources describe feature eligibility, without a country-by-country availability table, a per-account activation time or a separate new price for these five detectors. Confirm the applicable license and platform version in the relevant documentation and account terms. This guide does not turn eligibility into a pricing promise.
What should a repository maintainer check now?
First, list the credential types your project uses, look up the five exact names in the current support table, and confirm repository ownership, visibility, hosting platform and Secret Protection settings. Do not treat the Partner column as a repository-availability switch.
Second, review actual alerts in the Security and quality tab of repositories you are authorized to access. GitHub says secret scanning checks complete Git history across all branches and periodically rescans when new secret types are added. A detector announcement is not a receipt showing that a particular repository has finished scanning.
Third, if a real credential was exposed, promptly rotate it through the issuing platform and your team’s process, then check dependent configuration and the response outcome. GitHub notes that deleting a secret from history does not replace invalidating an exposed credential. Keep the necessary timing and type records without copying the real secret into tickets, chats or new commits.
Sources
Frequently Asked Questions
Are these provider-specific patterns the same as AI-detected passwords?
No. This guide checks five provider-specific patterns for Lovable, Pydantic and Supabase. GitHub documents AI-detected patterns as a separate category and lists password as an example. Check the support table for the capabilities of each category and pattern.
Can I ignore an earlier exposure after making the repository private?
A visibility change alone does not establish that an exposed credential is invalid. Continue checking and rotating through the issuing platform and your team’s process, and reassess Secret Protection eligibility for the private repository. This guide did not run a scan or validate any real key.