[daily secrets] 2026-05-17

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-05-17
Workflow Files Analyzed: 229
Run: §25998356476

📊 Executive Summary

Metric	Value
Total secrets.* references	5,898
github.token references	1,069
Unique secret types	36
Token cascade usages	860
Explicit permission blocks	229 (100%)
Workflows with redaction steps	229 (100%)

🛡️ Security Posture

✅ Redaction System: All 229/229 workflows include redaction steps
✅ Token Cascades: 860 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: All 229 workflows have explicit permissions: definitions
✅ Template Injection: github.event.* values are consistently sanitized via GH_AW_EXPR_* env variables — no raw interpolation found
✅ Secrets in Outputs: No secrets exposed as job outputs (false positive from grep resolved — occurrences are env var assignments)

🎯 Key Findings

1. Full OTEL Coverage: All 4 required OTEL secrets (GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION) are used in all 229 workflow files — telemetry infrastructure is fully provisioned.

2. GitHub Token Triad Dominance: The top 3 secrets (GH_AW_GITHUB_TOKEN 2,945, GITHUB_TOKEN 2,878, GH_AW_GITHUB_MCP_SERVER_TOKEN 1,287) account for 7,110 of 5,898 raw references (noting some overlap from cascade patterns) and represent the core auth layer.

3. AI Engine Secret Distribution: Multiple AI provider secrets are active — ANTHROPIC_API_KEY (249), OPENAI_API_KEY (73), CODEX_API_KEY (72), GEMINI_API_KEY (5), OPENROUTER_API_KEY (1) — reflecting multi-engine support.

💡 Recommendations

1. Audit low-usage secrets: OPENROUTER_API_KEY (1), SLACK_BOT_TOKEN (1), CONTEXT (2) appear in very few files — verify they're still needed or candidates for removal.

2. Monitor GH_AW_AGENT_TOKEN: Used in only 12 references. Confirm this is intentionally scoped or document its purpose to avoid confusion with GH_AW_GITHUB_TOKEN.

3. Azure credential review: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID each appear in only 2 files. Verify these aren't orphaned credentials.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GH_AW_GITHUB_TOKEN	2,945	GitHub Token
2	GITHUB_TOKEN	2,878	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,287	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	687	Observability
5	GH_AW_OTEL_GRAFANA_AUTHORIZATION	460	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	458	Observability
7	COPILOT_GITHUB_TOKEN	387	GitHub Token
8	ANTHROPIC_API_KEY	249	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	231	Observability
10	OPENAI_API_KEY	73	AI Provider
11	CODEX_API_KEY	72	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	55	CI/CD
13	GH_AW_SIDE_REPO_PAT	19	GitHub Token
14	TAVILY_API_KEY	13	External Service
15	GH_AW_AGENT_TOKEN	12	GitHub Token

🔍 All 36 Unique Secret Types

Secret Name	Count	Category
GH_AW_GITHUB_TOKEN	2,945	GitHub Token
GITHUB_TOKEN	2,878	GitHub Token
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,287	GitHub Token
GH_AW_OTEL_SENTRY_AUTHORIZATION	687	Observability
GH_AW_OTEL_GRAFANA_AUTHORIZATION	460	Observability
GH_AW_OTEL_SENTRY_ENDPOINT	458	Observability
COPILOT_GITHUB_TOKEN	387	GitHub Token
ANTHROPIC_API_KEY	249	AI Provider
GH_AW_OTEL_GRAFANA_ENDPOINT	231	Observability
OPENAI_API_KEY	73	AI Provider
CODEX_API_KEY	72	AI Provider
GH_AW_CI_TRIGGER_TOKEN	55	CI/CD
GH_AW_SIDE_REPO_PAT	19	GitHub Token
TAVILY_API_KEY	13	External Service
GH_AW_AGENT_TOKEN	12	GitHub Token
GH_AW_PROJECT_GITHUB_TOKEN	7	GitHub Token
SENTRY_OPENAI_API_KEY	6	Observability
SENTRY_ACCESS_TOKEN	6	Observability
NOTION_API_TOKEN	6	External Service
GH_AW_OTEL_HEADERS	6	Observability
GEMINI_API_KEY	5	AI Provider
GRAFANA_URL	4	Observability
GRAFANA_SERVICE_ACCOUNT_TOKEN	4	Observability
GH_AW_OTEL_ENDPOINT	4	Observability
BRAVE_API_KEY	4	External Service
DD_SITE	3	Observability
DD_APPLICATION_KEY	3	Observability
DD_API_KEY	3	Observability
SENTRY_API_KEY	2	Observability
CONTEXT	2	Other
AZURE_TENANT_ID	2	Cloud Provider
AZURE_CLIENT_SECRET	2	Cloud Provider
AZURE_CLIENT_ID	2	Cloud Provider
SLACK_BOT_TOKEN	1	External Service
OPENROUTER_API_KEY	1	AI Provider

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-05-17T17:56 UTC
Workflow: §25998356476

Generated by 🔒 Daily Secrets Analysis Agent · ● 3.1M · ◷

• expires on May 20, 2026, 5:59 PM UTC