[daily secrets] 🔐 Secrets Analysis Report — 2026-06-20

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-06-20
Workflow Files Analyzed: 249
Run: §27879344731

---

📊 Executive Summary

Metric	Value
Total secrets.* References	7,321
github.token References	1,511
Combined Secret References	8,832
Unique Secret Types	39
Workflows Analyzed	249

Secret reference density: ~35.5 refs per workflow on average.

---

🛡️ Security Posture

Control	Status	Coverage
Secrets Redaction Steps	✅ Active	249/249 (100%)
Explicit Permission Blocks	✅ Active	249/249 (100%)
Hardcoded Tokens	✅ None Found	0 detected
Secrets in Job Outputs	✅ Clean	0 found
Template Injection (github.event in run:)	✅ Safe	0 unsafe usages
Token Cascade Fallback Chains	✅ Active	899 instances
secrets: inherit Usage	✅ None	0 workflows

All 4,422 github.event.* references safely use the env-variable pattern (GH_AW_EXPR_*: ${{ github.event.xxx }}), with zero direct interpolation in run: scripts.

---

🎯 Key Findings

1. Full Security Control Coverage: All 249 workflows have both redaction steps and explicit permissions: blocks — 100% compliance, no gaps.

2. GitHub Token Dominance: GitHub authentication tokens account for ~96% of all secrets.* references. GITHUB_TOKEN (4,099) and GH_AW_GITHUB_TOKEN (3,216) together represent ~99% of the GitHub token category.

3. Universal Token Cascade: All 249 workflows implement the three-level fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN), providing resilient, least-privilege token selection across 899 cascade instances.

4. AI/LLM Provider Diversity: 7 distinct AI providers are represented. Anthropic Claude leads with 228 refs (~55% of AI key usage), followed by OpenAI (81) and Codex (80). This diversity reduces single-provider dependency.

5. CONTEXT Secret — Unusual Name: 2 occurrences of a secret named CONTEXT were found. This is worth verifying that it follows naming conventions and doesn't accidentally expose sensitive context blobs.

---

💡 Recommendations

1. Review CONTEXT Secret: Investigate the 2 workflows using secrets.CONTEXT to confirm the name is intentional and the value contains only expected data. Consider renaming to a more descriptive name (e.g., GH_AW_CONTEXT) for clarity.

2. Monitor AI Key Growth: Anthropic usage (228 refs) has surpassed OpenAI (81) as the primary LLM provider. Track whether new AI provider secrets are added through the standard review process.

3. Maintain Redaction Coverage: The current 100% redaction coverage is exemplary. Ensure any new workflows added to CI are validated to include redaction steps before merge.

---

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,099	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,216	GitHub Auth
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,360	GitHub Auth
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	693	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	463	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	461	Observability
7	COPILOT_GITHUB_TOKEN	445	GitHub Auth
8	GH_AW_OTEL_GRAFANA_ENDPOINT	231	Observability
9	ANTHROPIC_API_KEY	228	AI/LLM
10	GH_AW_CI_TRIGGER_TOKEN	58	GitHub Auth
11	GH_AW_SIDE_REPO_PAT	24	GitHub Auth
12	OPENAI_API_KEY	81	AI/LLM
13	CODEX_API_KEY	80	AI/LLM
14	GH_AW_AGENT_TOKEN	13	GitHub Auth
15	TAVILY_API_KEY	12	AI/LLM
16	SENTRY_OPENAI_API_KEY	10	Observability
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability
19	DD_APPLICATION_KEY	10	Observability
20	DD_API_KEY	8	Observability

📂 Secret Categories Breakdown

Category	Secrets Count	Total Refs
GitHub Auth Tokens	8	~9,421
Observability (OTEL/Sentry/Grafana/DD/Slack)	14	~2,136
AI/LLM Keys	13	~421
Cloud/Integration (Azure, Notion, Context)	6	~14

GitHub Auth Tokens (8 secrets): GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GH_AW_SIDE_REPO_PAT, GH_AW_AGENT_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN

AI/LLM Keys (13 secrets): Anthropic, OpenAI, Codex, Gemini, Foundry (×2), Brave, Tavily, Antigravity, OpenRouter, Sentry-OpenAI

Observability (14 secrets): OTEL Sentry/Grafana/Datadog endpoints & auth, DD_*, GRAFANA_*, SENTRY_ACCESS_TOKEN, SLACK_BOT_TOKEN

Cloud/Integration (6 secrets): Azure (Client ID/Secret/Tenant), NOTION_API_TOKEN, CONTEXT

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-06-20T18:01:55Z
Workflow: §27879344731

Generated by 🔒 Daily Secrets Analysis Agent · 42.9 AIC · ⌖ 8.56 AIC · ⊞ 6.1K · ◷

• expires on Jun 23, 2026, 10:06 AM UTC-08:00