Commit links get a hall pass
Paste a GitHub commit or blob link into the composer and the amber secret warning no longer pops up. A real secret in the same post still gets caught and redacted.
You paste a link to the fix, something like the commit page for your last patch, and the amber shield box that used to appear under the composer stays away. Keep typing and your draft keeps saving. Paste a 40-character hash on its own, labeled as a client secret, and the shield is back, with the hash selected and a button to scrub it.
Credit goes to rohitsasi720, who taught the scanner the difference between an address and a credential. GitHub links are full of 40-character hex strings, and one of the scanner's rules reads every such string as a GitHub OAuth token once the word github appears in your text. The new check looks at the characters before the match. If they describe a host and a path ending in a slash, the hash is part of the address and is left alone. All three places that care agree, so the warning, the remove-secrets button and the draft stash now say the same thing.
One catch. It judges by shape, not by asking GitHub. The link needs a host with a dot in it, so a commit URL on an intranet machine like http://gitbox/commit/<hash> still raises the warning, and so does a hash you type in prose rather than link.