[daily secrets] 2026-05-10 Secret Usage Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-05-10
Workflow Files Analyzed: 218
Run: §25635652965

---

📊 Executive Summary

Metric	Value
Total secrets.* references	5,378
github.token references	1,001
Unique secret types	31
Workflows analyzed	218

---

🛡️ Security Posture

Check	Status	Count
Redaction steps	✅ All workflows	218 / 218
Token fallback cascades	✅ Present	814 instances
Explicit permission blocks	✅ All workflows	218 / 218
Secrets in job outputs	✅ None	0
Template injection (github.event.* in env vars)	✅ Safe pattern	Used correctly in env: blocks

All 218 workflows have redaction steps and explicit permission blocks — excellent security posture.

github.event.* references are consistently set via env: variables (the recommended safe pattern), not used in inline expressions.

---

🎯 Key Findings

1. Token cascade pattern is robust: 814 instances of ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} provide graceful fallback across all agent workflows.

2. Top 3 secrets dominate usage: GH_AW_GITHUB_TOKEN (2,798), GITHUB_TOKEN (2,740), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,219) account for ~63% of all secret references — expected for a GitHub-centric agent platform.

3. AI engine secrets well-distributed: ANTHROPIC_API_KEY (245), COPILOT_GITHUB_TOKEN (355), OPENAI_API_KEY (73), CODEX_API_KEY (72) reflect healthy multi-engine support.

4. Redaction is universal: 100% of workflow files include redaction steps — this is the strongest indicator of a mature secrets management posture.

---

💡 Recommendations

1. Audit low-usage secrets: SLACK_BOT_TOKEN (1), OPENROUTER_API_KEY (1), CONTEXT (2) appear rarely — confirm they are actively needed or clean up unused references.

2. Monitor secrets.* in env blocks after outputs:: 37 matches appeared in a grep near outputs: lines; verify these are env vars (safe) and not actual job output values exposing secrets.

3. Track OTEL secret pairs together: GH_AW_OTEL_HEADERS and GH_AW_OTEL_ENDPOINT always appear together (437 each) — consider bundling into a single composite secret for easier rotation.

---

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GH_AW_GITHUB_TOKEN	2,798	GitHub Token
2	GITHUB_TOKEN	2,740	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,219	GitHub MCP Token
4	GH_AW_OTEL_HEADERS	437	Observability
5	GH_AW_OTEL_ENDPOINT	437	Observability
6	COPILOT_GITHUB_TOKEN	355	AI Engine
7	ANTHROPIC_API_KEY	245	AI Engine
8	OPENAI_API_KEY	73	AI Engine
9	CODEX_API_KEY	72	AI Engine
10	GH_AW_CI_TRIGGER_TOKEN	50	CI/CD
11	GH_AW_SIDE_REPO_PAT	19	Repository Access
12	GH_AW_AGENT_TOKEN	17	Agent Auth
13	TAVILY_API_KEY	13	Search API
14	GH_AW_PROJECT_GITHUB_TOKEN	7	Project Access
15	NOTION_API_TOKEN	6	Integration

🗂️ All 31 Unique Secret Types

Secret	Count	Category
ANTHROPIC_API_KEY	245	AI Engine
AZURE_CLIENT_ID	2	Cloud Auth
AZURE_CLIENT_SECRET	2	Cloud Auth
AZURE_TENANT_ID	2	Cloud Auth
BRAVE_API_KEY	4	Search API
CODEX_API_KEY	72	AI Engine
CONTEXT	2	Custom
COPILOT_GITHUB_TOKEN	355	AI Engine
DD_API_KEY	3	Observability
DD_APPLICATION_KEY	3	Observability
DD_SITE	3	Observability
GEMINI_API_KEY	5	AI Engine
GH_AW_AGENT_TOKEN	17	Agent Auth
GH_AW_CI_TRIGGER_TOKEN	50	CI/CD
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,219	GitHub MCP Token
GH_AW_GITHUB_TOKEN	2,798	GitHub Token
GH_AW_OTEL_ENDPOINT	437	Observability
GH_AW_OTEL_HEADERS	437	Observability
GH_AW_PROJECT_GITHUB_TOKEN	7	Project Access
GH_AW_SIDE_REPO_PAT	19	Repository Access
GITHUB_TOKEN	2,740	GitHub Token
GRAFANA_SERVICE_ACCOUNT_TOKEN	2	Observability
GRAFANA_URL	2	Observability
NOTION_API_TOKEN	6	Integration
OPENAI_API_KEY	73	AI Engine
OPENROUTER_API_KEY	1	AI Engine
SENTRY_ACCESS_TOKEN	4	Error Tracking
SENTRY_API_KEY	2	Error Tracking
SENTRY_OPENAI_API_KEY	4	Error Tracking
SLACK_BOT_TOKEN	1	Notification
TAVILY_API_KEY	13	Search API

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-05-10T17:55 UTC
Workflow: Daily Secrets Analysis

Generated by Daily Secrets Analysis Agent · ● 2.8M · ◷

• expires on May 13, 2026, 5:58 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #31554.