[daily secrets] Secrets Analysis Report — 2026-07-05

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-05
Workflow Files Analyzed: 258
Run: §28749697979

---

📊 Executive Summary

Metric	Value
Total secrets.* references	12,234
Lines containing secrets.*	7,580
github.token references	1,572
Unique secret types	40
Step-level secret usages	3,136
Token cascade patterns	930

Secrets span 3 major categories: GitHub tokens (75% of refs), observability (17%), and AI/LLM API keys (3.5%), with the remainder covering cloud infra, Slack, Notion, and PATs.

---

🛡️ Security Posture

Control	Status	Coverage
Redaction steps	✅ Active	258/258 (100%)
Permission blocks	✅ Defined	258/258 (100%)
Token cascade fallback	✅ In use	930 instances
Template injection (run: blocks)	⚠️ 13 instances	Low risk (all via env:)

All 258 workflows include explicit permissions: blocks and redact_secrets steps — indicating consistent baseline security hygiene across the full workflow suite.

The 13 github.event.* usages in run: blocks are all passed via environment variable assignments (not raw shell interpolation), making exploitation difficult. They reference PR numbers, SHAs, and run IDs — numeric or hash values with limited injection surface.

---

⚠️ Findings

1. Token-heavy footprint: GITHUB_TOKEN + GH_AW_GITHUB_TOKEN alone account for ~62% of all secret references (7,585 of 12,234). This is expected for an agentic workflow platform but warrants monitoring for unauthorized expansion.

2. Observability secrets widely distributed: GH_AW_OTEL_SENTRY_* and GH_AW_OTEL_GRAFANA_* appear in 1,896 references across workflows — ensuring telemetry but increasing the blast radius if these are compromised.

3. AI API key usage dominated by Anthropic: ANTHROPIC_API_KEY (242) leads, followed by OPENAI_API_KEY (81) and CODEX_API_KEY (80). 9 distinct AI provider keys are in use, suggesting broad multi-model strategy.

4. Azure credentials present (limited): AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID each appear only 2 times — tightly scoped, low exposure.

5. Stale or legacy keys: NOTION_API_TOKEN, SLACK_BOT_TOKEN, and SENTRY_OPENAI_API_KEY appear in <15 references each — verify these are actively needed.

---

💡 Recommendations

1. Audit GH_AW_OTEL_* scope: With 1,896 references across observability secrets, ensure these are scoped to workflows that genuinely require telemetry and not inherited broadly.

2. Review github.event.* in run: blocks: While low risk today (env: wrapper), consider pre-computing these values in a ${{ }} expression context to follow defense-in-depth.

3. Rationalize AI API keys: With 9 distinct AI providers, review if all are actively used. Unused keys in compiled workflows should be removed to minimize secret sprawl.

4. Monitor GITHUB_TOKEN usage growth: At 4,253 refs, ensure GITHUB_TOKEN usage follows least-privilege patterns and is not used where a more scoped token would suffice.

5. Validate SLACK_BOT_TOKEN / NOTION_API_TOKEN: Low reference counts (<10 each) may indicate unused integrations — audit and revoke if not needed.

---

🔑 Top 10 Secrets by Reference Count

Rank	Secret Name	References	Category
1	GITHUB_TOKEN	4,253	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,332	GitHub PAT
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,407	GitHub PAT
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	711	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	475	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	473	Observability
7	COPILOT_GITHUB_TOKEN	452	GitHub PAT
8	ANTHROPIC_API_KEY	242	AI/LLM
9	GH_AW_OTEL_GRAFANA_ENDPOINT	237	Observability
10	OPENAI_API_KEY	81	AI/LLM

🤖 AI/LLM API Keys Breakdown

Secret	References
ANTHROPIC_API_KEY	242
OPENAI_API_KEY	81
CODEX_API_KEY	80
TAVILY_API_KEY	12
ANTIGRAVITY_API_KEY	6
GEMINI_API_KEY	5
FOUNDRY_API_KEY	3
FOUNDRY_OPENAI_ENDPOINT	2
BRAVE_API_KEY	4
OPENROUTER_API_KEY	1

Total AI/LLM secret refs: ~436 across 9 providers

📡 Observability Secrets Breakdown

Secret	References
GH_AW_OTEL_SENTRY_AUTHORIZATION	711
GH_AW_OTEL_SENTRY_ENDPOINT	475
GH_AW_OTEL_GRAFANA_AUTHORIZATION	473
GH_AW_OTEL_GRAFANA_ENDPOINT	237
DD_APP_KEY	10
DD_APPLICATION_KEY	10
SENTRY_ACCESS_TOKEN	10
SENTRY_OPENAI_API_KEY	10
DD_API_KEY	8
GRAFANA_SERVICE_ACCOUNT_TOKEN	6
GRAFANA_URL	6

⚠️ Template Injection Candidates (13 instances)

These use ${{ github.event.* }} in run: step blocks, passed via env:

File	Line	Usage
ci-doctor.lock.yml	579	RUN_ID: ${{ github.event.workflow_run.id }}
ci-doctor.lock.yml	585	HEAD_SHA: ${{ github.event.pull_request.head.sha }}
ci-doctor.lock.yml	586	PR_NUMBER: ${{ github.event.pull_request.number }}
agentic-token-trend-audit.lock.yml	509	DATE_RANGE_INPUT: ${{ github.event.inputs.date_range }}
deep-report.lock.yml	596	REPO_NAME: ${{ github.event.repository.name }}
uk-ai-operational-resilience.lock.yml	545	LOOKBACK_DAYS: ${{ github.event.inputs.lookback_days || '7' }}
design-decision-gate.lock.yml	573	PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
test-quality-sentinel.lock.yml	573, 575	PR base SHA and number
impeccable-skills-reviewer.lock.yml	559	PR_NUMBER: ${{ github.event.pull_request.number }}
pr-description-caveman.lock.yml	479, 481	Base/head SHAs
mattpocock-skills-reviewer.lock.yml	706	PR_NUMBER: ${{ github.event.pull_request.number }}

All values are numeric/SHA types with minimal injection surface. Risk level: Low.

📖 Reference Documentation

• Secret specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Workflow run: §28749697979

---

Generated: 2026-07-05 17:58 UTC
Analyzed: 258 .lock.yml files across .github/workflows/

Generated by 🔒 Daily Secrets Analysis Agent · 40.1 AIC · ⌖ 5.97 AIC · ⊞ 6.3K · ◷

• expires on Jul 8, 2026, 10:02 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #43852.