[daily secrets] 2026-06-29 — Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-06-29
Workflow Files Analyzed: 257
Run: §28393458702

---

📊 Executive Summary

Metric	Value
secrets.* references	7,553
github.token references	1,562
Total secret/token references	9,115
Unique named secrets	39
Token cascade chains (`

Breakdown by category:

Category	References	% of secrets.*
GitHub tokens (all variants)	5,791	76.7%
Observability/OTEL	951	12.6%
AI API keys	413	5.5%
CI/CD & cross-repo	91	1.2%
Other (DD, Azure, Grafana, etc.)	307	4.1%

---

🛡️ Security Posture

Control	Status	Coverage
Secret redaction steps	✅ All workflows	257/257 (100%)
Explicit permissions: blocks	✅ All workflows	257/257 (100%)
Token cascade fallback chains	✅ Present	926 instances
DIFC outbound proxy (enhanced sandbox)	⚠️ Partial	155/257 (60%)
Template injection risks	✅ None	0 confirmed
Secrets in job outputs	✅ None	0 found

All github.event.* context values are safely marshalled into environment variables before reaching shell steps — no direct expression interpolation in run: blocks.

---

🔍 Key Findings

1. Perfect baseline coverage: 100% of workflows have both secret redaction and explicit permissions — a strong foundation.

2. DIFC proxy coverage at 60%: 155 of 257 workflows run with the DIFC outbound traffic proxy. The 102 non-DIFC workflows are primarily read-only audit/analysis workflows (e.g., ace-editor, agentic-token-audit), suggesting this split is intentional by security tier.

3. Dual Datadog key names: DD_APP_KEY (10 refs) and DD_APPLICATION_KEY (10 refs) coexist and are used as mutual fallbacks (${{ secrets.DD_APPLICATION_KEY || secrets.DD_APP_KEY }}). While safe, maintaining two secrets for the same purpose increases operational overhead.

4. Low-use secrets: Five secrets have only 1–2 occurrences — SLACK_BOT_TOKEN (1), OPENROUTER_API_KEY (1), GH_AW_OTEL_DATADOG_ENDPOINT (1), CONTEXT7_API_KEY (2), GH_AW_OTEL_DATADOG_ENDPOINT (1) — concentrated in single workflows. Worth auditing for continued necessity.

5. Azure credential isolation: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID appear exclusively in mcp-inspector.lock.yml (2 refs each) — well-isolated.

6. AI key concentration: ANTHROPIC_API_KEY is the dominant AI key (242 refs, 62 workflows / 24%). OPENAI_API_KEY (87 refs) and CODEX_API_KEY (86 refs) follow, suggesting near-equivalent Codex/OpenAI rollout.

---

💡 Recommendations

1. Consolidate DD_APP_KEY / DD_APPLICATION_KEY: Choose one canonical name and migrate all references. The current cascade pattern works but adds confusion.

2. Audit single-use secrets: Review SLACK_BOT_TOKEN, OPENROUTER_API_KEY, CONTEXT7_API_KEY, and GH_AW_OTEL_DATADOG_ENDPOINT — if the hosting workflow is experimental or deprecated, revoke and remove these secrets to reduce the attack surface.

3. Document DIFC coverage split: The 60%/40% DIFC/non-DIFC split appears intentional but is not documented. Adding a comment or manifest field (security_tier: standard|enhanced) would make the distinction explicit and auditable.

---

🔑 All 39 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,227	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,320	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,401	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	711	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	475	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	473	Observability
7	COPILOT_GITHUB_TOKEN	448	GitHub Token
8	ANTHROPIC_API_KEY	242	AI API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	237	Observability
10	OPENAI_API_KEY	87	AI API Key
11	CODEX_API_KEY	86	AI API Key
12	GH_AW_CI_TRIGGER_TOKEN	60	CI/CD Token
13	GH_AW_SIDE_REPO_PAT	24	GitHub PAT
14	GH_AW_AGENT_TOKEN	14	GitHub Token
15	TAVILY_API_KEY	12	AI Tool API
16	SENTRY_OPENAI_API_KEY	10	AI API Key
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability (Datadog)
19	DD_APPLICATION_KEY	10	Observability (Datadog)
20	DD_API_KEY	8	Observability (Datadog)
21	GH_AW_PROJECT_GITHUB_TOKEN	7	GitHub Token
22	DD_SITE	7	Observability (Datadog)
23	NOTION_API_TOKEN	6	Integration
24	GRAFANA_URL	6	Observability
25	GRAFANA_SERVICE_ACCOUNT_TOKEN	6	Observability
26	FOUNDRY_OPENAI_ENDPOINT	6	AI API Endpoint
27	ANTIGRAVITY_API_KEY	6	AI API Key
28	GEMINI_API_KEY	5	AI API Key
29	BRAVE_API_KEY	4	Search API
30	FOUNDRY_API_KEY	3	AI API Key
31	AWI_MAINTENANCE_TOKEN	3	GitHub Token
32	GH_AW_OTEL_DATADOG_API_KEY	2	Observability
33	CONTEXT7_API_KEY	2	Documentation API
34	AZURE_TENANT_ID	2	Azure Auth
35	AZURE_CLIENT_SECRET	2	Azure Auth
36	AZURE_CLIENT_ID	2	Azure Auth
37	SLACK_BOT_TOKEN	1	Messaging
38	OPENROUTER_API_KEY	1	AI API Key
39	GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability

Note: Count reflects all occurrences including token cascade chains (e.g., secrets.A \|\| secrets.B \|\| secrets.C counts as 3 refs).

📊 Distribution Statistics

Step-level env blocks: 13,439
Job-level env blocks: 1,559

AI API key-bearing workflows: 62/257 (24%) — includes ANTHROPIC, OPENAI, GEMINI, CODEX, FOUNDRY, OPENROUTER, BRAVE, TAVILY
Observability-instrumented workflows: All 257 (via GH_AW_OTEL_* secrets)

github.event. usage pattern*: 4,573 total references, all safely via env: variable assignment — zero direct shell interpolation confirmed.

📖 Reference Documentation

• Secret specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-06-29T18:21 UTC
Workflow: §28393458702

Generated by 🔒 Daily Secrets Analysis Agent · 64.6 AIC · ⌖ 9.51 AIC · ⊞ 6.2K · ◷

• expires on Jul 2, 2026, 10:29 AM UTC-08:00