How GitHub expanded secret validity checks with Copilot coding agent
GitHub's Secret Protection team had engineers do the research, then gave Copilot coding agent the repetitive work of adding validators for more leaked-token types. Coverage grew quickly.
The problem
Secret Protection checks whether a leaked credential is still valid by testing it against a harmless API endpoint. Only 32 token types were covered, and adding less common types through the existing framework was slow.
How they did it
- Engineers researched which API endpoints could validate each new token type.
- A GitHub workflow turned that research into detailed issues that served as prompts for the agent.
- Copilot coding agent opened pull requests, and engineers reviewed, tested and asked for changes through PR comments.
- New validators first ran in 'darkship' mode to observe results safely.
- Copilot then made the configuration changes to fully release them.
Results
- As reported by GitHub: the team went from validating '32 partner token types' to onboarding 'almost 90 new types in just a few weeks'.
As reported by the source (GitHub blog (engineering)); AgentGid did not measure these figures.
This suits a team with engineers who can research each item and write detailed issues, plus the review capacity to test every PR. The "almost 90 types in a few weeks" figure is GitHub's own report, and the cloud agent draws on monthly AI Credits (Pro includes 1,500 at $10/mo), so heavy batches of issues may use them up. Zed (Free + $10/mo) is an open-source option if you want to try a similar workflow with your own API keys.
The agent used here
Similar use cases
JustHTML: a Python HTML5 parser built with coding agents that passes html5lib tests
A developer spent his off-hours using Copilot agent mode with several models to build a dependency-free HTML5 parser, and wrote up every stage, including a full restart.
JustHTML is about 3,000 lines of Python with 8,500+ tests passing.
Generate unit and integration tests with GitHub Copilot
GitHub's tutorial uses Copilot Chat to write a unit test suite for a class, then integration tests that mock an external notification service, and then asks what coverage is still…
A unit test suite that covers edge cases, exceptions and data validation.
Assign a GitHub issue to Copilot and get back a pull request
You assign an issue to Copilot just like a teammate. It works in the background, pushes its changes to a pull request and asks you to review it.
Copilot investigates the task, pushes its changes to a pull request and then requests your review.
Guides
Best AI Agents in 2026: Live Rankings by Category
The leading AI agents for coding, design, research, data, marketing, sales, support, HR, finance, legal, DevOps and security, ranked by public usage data that refreshes daily, with prices and free options.
AI Agent Statistics 2026: Live Usage, Growth and Activity Data
Current statistics on AI agents from public data: package downloads, editor installs, GitHub stars, pull requests opened by coding agents, release pace and benchmark results. Updated daily.
Best AI Coding Agents in 2026: Ranked by Usage, Benchmarks and Price
The AI coding agents developers use most, with live download and install numbers, benchmark results, entry prices and a way to choose between terminal, IDE and cloud agents.